Ransomware.live: clop

| Active

The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.

At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware.

After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp, .Cllp, and .C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption. Depending on the variant, any of the ransom text files were created with names like 'ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.'

The Clop operation has shifted from delivering its final payload via phishing and has begun initiating attacks using vulnerabilities that resulted in the exploitation and infection of victims' infrastructures.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

1254

First Discovered

2020-03-13

victim

Last Discovered

2026-05-01

victim

Inactive Since

days

Avg Delay

days

Infostealer

36.7%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

2 victims this month

Known Locations (3)

Title	Available	Last Visit	FQDN
	No	2026-04-28T07:21:51	`ekbgzchl6x2ias37.onion`
DDOS Protection	Yes	2026-05-15T18:35:39	`santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion`
TORRENT \| CL0P^_- LEAKS	No	2026-04-28T07:22:31	`toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion`

Target

Heatmap

Ransom Notes (4)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	Cobalt Strike PowerShell Empire TinyMet	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder

Vulnerabilities Exploited (7)

This information is provided by Ransomware-Vulnerability-Matrix
Vendor	Product	CVE	Source
Accellion	Accellion File Transfer Appliance	CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104	mandiant.com
Cleo	Cleo VLTrader, Harmony, LexiCom	CVE-2024-55956	huntress.com
Fortra	GoAnywhere Managed File Transfer	CVE-2023-0669	censys.io
Oracle	E-Business	CVE-2025-61882	crowdstrike.com
Progress Software	MOVEit	CVE-2023-34362	cisa.gov
PaperCut	PaperCut Application Server	CVE-2023-27350, CVE-2023-27351	twitter.com/MsftSecIntel
SolarWinds	SolarWinds Serv-U FTP	CVE-2021-35211	research.nccgroup.com

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid accounts	Command and scripting interpreter	Create or modify system process: Windows service	Exploitation for privilege escalation	Masquerading: invalid code signature	Query registry	Remote services: SMB/Windows admin shares	Data from local system	Exfiltration over web service	Application Layer Protocol	Data encrypted for impact
Exploit public-facing application	Native API	Boot or logon autostart execution	Domain Policy modification: Group Policy modification	Process injection: DLL injection	Remote system discovery	Lateral tool transfer				Inhibit system recovery
Phishing: Spear-phishing attachment	User execution		Hijack execution flow	Indicator removal on host: clear Windows event logs	Process discovery
				Indicator removal on host: file deletion	Security software discovery
				Deobfuscate/Decode files or information	System information discovery
				Indirect command execution	File and directory discovery
				Impair defenses: disable or modify tools

YARA Rules (1)

Indicators of Compromise (IoCs) (9)

Email 9

Type	IOC
`Email`	`managersmaers@tutanota.com`
`Email`	`servicedigilogos@protonmail.com`
`Email`	`support@he1p-center.com`
`Email`	`support@in2pay.com`
`Email`	`unlock@cl-leaks.com`
`Email`	`unlock@goto-pay.com`
`Email`	`unlock@he1p-me.com`
`Email`	`unlock@rsv-box.com`
`Email`	`unlock@support-box.com`