Clop

| Active

The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.

At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware.

After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp, .Cllp, and .C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption. Depending on the variant, any of the ransom text files were created with names like 'ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.'

The Clop operation has shifted from delivering its final payload via phishing and has begun initiating attacks using vulnerabilities that resulted in the exploitation and infection of victims' infrastructures.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

1025

First Discovered

victim

2020-03-13

Last Discovered

victim

2025-10-27

Inactive Since

in days

3

Avg Delay

between attack and claim

6 days

Infostealer

for victim with domain

12.9%

View Victims on World Map

View group statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
None	No	2025-06-01 21:18:12	`ekbgzchl6x2ias37.onion`
DDOS Protection	Yes	2025-10-30 13:31:12	`santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion`
TORRENT \| CL0P^_- LEAKS	No	2025-06-01 21:19:13	`toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (4)

Tools Used (Not Available)

Vulnerabilities Exploited (6)

This information is provided by Ransomware-Vulnerability-Matrix
Vendor	Product	CVE	Source
Accellion	Accellion File Transfer Appliance	CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104	mandiant.com
Cleo	Cleo VLTrader, Harmony, LexiCom	CVE-2024-55956	huntress.com
Fortra	GoAnywhere Managed File Transfer	CVE-2023-0669	censys.io
Progress Software	MOVEit	CVE-2023-34362	cisa.gov
PaperCut	PaperCut Application Server	CVE-2023-27350, CVE-2023-27351	twitter.com/MsftSecIntel
SolarWinds	SolarWinds Serv-U FTP	CVE-2021-35211	research.nccgroup.com

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Phishing: Spear-phishing attachment	Native API	Boot or logon autostart execution	Domain Policy modification: Group Policy modification	Masquerading: invalid code signature	File and directory discovery	Lateral tool transfer	Data from local system	Application Layer Protocol	Exfiltration over web service	Data encrypted for impact
Exploit public-facing application	Command and scripting interpreter	Create or modify system process: Windows service	Exploitation for privilege escalation	Impair defenses: disable or modify tools	Remote system discovery	Remote services: SMB/Windows admin shares				Inhibit system recovery
Valid accounts	User execution		Hijack execution flow	Deobfuscate/Decode files or information	Process discovery
				Indicator removal on host: file deletion	System information discovery
				Process injection: DLL injection	Query registry
				Indirect command execution	Security software discovery
				Indicator removal on host: clear Windows event logs

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (0)

Victims (1025)

DAVIDYURMAN.COM Clop

Discovery Date: 2025-10-27

[AI generated] DAVIDYURMAN.COM is the official online store for the luxury jewelry and timepiece bra...

PANAMERICANSILVER.COM Clop

Discovery Date: 2025-10-27

[AI generated] Pan American Silver Corp. is a Canada-based mining company engaged in the production ...

COXENTERPRISES.COM Clop

Discovery Date: 2025-10-27

[AI generated] Cox Enterprises, Inc. is an American conglomerate based in Atlanta, Georgia. The comp...

HRSD.COM Clop

Discovery Date: 2025-10-27

[AI generated] HRSD.COM, or Hampton Roads Sanitation District (HRSD), is a municipal organization in...

CSCGLOBAL.COM Clop

Discovery Date: 2025-10-27

[AI generated] CSCGlobal.com is the website of Corporation Service Company (CSC), a recognized leade...

AUSENCO.COM Clop

Discovery Date: 2025-10-27

[AI generated] Ausenco is a global engineering and consulting firm based in Australia. The company o...

LKQCORP.COM Clop

Discovery Date: 2025-10-27

[AI generated] LKQ Corporation is a leading provider of alternative and specialty parts to repair an...

MILGARD.COM Clop

Discovery Date: 2025-10-27

[AI generated] Milgard.com is a manufacturer and supplier of high-quality windows and doors in the U...

COPELAND.COM Clop

Discovery Date: 2025-10-27

[AI generated] N/A...

WITS.AC.ZA Clop

Discovery Date: 2025-10-27

[AI generated] WITS.AC.ZA is the online domain for the University of the Witwatersrand, located in J...

HARVARD.EDU Clop

Discovery Date: 2025-10-27

[AI generated] Harvard.edu is the official website of Harvard University, a private Ivy League resea...

PHARMARON.COM Clop

Discovery Date: 2025-07-07

[AI generated] Pharmaron is a global drug research and development service provider. The company off...

PILOTTHOMAS.COM Clop

Discovery Date: 2025-07-07

[AI generated] Pilot Thomas Logistics is a US-based company leading in the provision of fuel, lubric...

CHECKCITY.COM Clop

Discovery Date: 2025-05-09

[AI generated] CheckCity.com is a financial services company based in Provo, Utah. It offers a varie...

CALTON.COM Clop

Discovery Date: 2025-04-13

[AI generated] N/A...

JAGGEDPEAK.COM Clop

Discovery Date: 2025-03-14

[AI generated] Jagged Peak is a technology-focused company that provides enterprise-class eCommerce ...

RACKSPACE.COM Clop

Discovery Date: 2025-03-14

[AI generated] Rackspace is a leading global provider of multi-cloud and managed application service...

LIPPERTENT.COM Clop

Discovery Date: 2025-03-14

WE PURCHASE OBSOLETE AND SLOW MOVING INVENTORY - With 40+ years of experience, we can purchase and a...

GARANIMALS.COM Clop

Discovery Date: 2025-03-14

[AI generated] Garanimals.com is a well-known children's clothing brand trading from the US. The bra...

IOVATE.COM Clop

Discovery Date: 2025-03-04

[AI generated] Iovate Health Sciences International Inc. is a dynamic, leading-edge nutritional comp...

JEFFREYCOURT.COM Clop

Discovery Date: 2025-03-01

[AI generated] Jeffrey Court is a leading innovator in decorative mosaic, glass, and stone tile desi...

APTEAN.COM Clop

Discovery Date: 2025-03-01

[AI generated] Aptean is a global software provider specializing in industry-specific solutions. It ...