Home › Threat Actors › Cl0p
← All Threat Actors
Cybercrime critical Eastern Europe (likely Russia/Ukraine)

Cl0p

Russian-speaking cybercrime group · Financial — ransomware and extortion

Reports 3
Active Since 2019
Last Reported 15 Aug 2026
Sectors Targeted critical-infrastructure, finance, government, healthcare, transport

Tactics, Techniques & Procedures (TTPs)

  • Mass exploitation of file transfer vulnerabilities (MOVEit, GoAnywhere, Accellion)
  • Data exfiltration and double-extortion
  • Supply chain targeting via MFT software
  • Minimal dwell time — fast exfil before encryption
  • Public shaming via leak site
  • Identifies and mass-exploits a single vulnerability in widely-used enterprise file transfer/MFT platforms across hundreds of organisations simultaneously (MOVEit Transfer 2023: 2,500+ orgs; GoAnywhere MFT 2023: 130 confirmed victims; Cleo 2024: hundreds more)
  • Bulk data exfiltration with no encryption stage — data theft and exposure threat is the entire attack chain
  • Extortion backed by threat of publication on a dark web leak site
  • Compressed exploitation window: historically days, not weeks, between a file-transfer-platform CVE disclosure and active exploitation

Known Targets

Global financial servicesHealthcare and pharmaGovernment agenciesTransport and logisticsUniversities and researchShell (claimed, 14 August 2026, ~89GB claimed stolen — Shell confirmed investigating a 'potential incident'; initial access vector unconfirmed at time of reporting)Broad, simultaneous victim pools across energy, finance, transport, and manufacturing sectors wherever vulnerable file-transfer platforms are deployedHistorical mass-victim campaigns via MOVEit Transfer, GoAnywhere MFT, and Cleo

Analyst Notes

Specialises in zero-day exploitation of managed file transfer (MFT) software, compromising hundreds of organisations simultaneously. Believed to be affiliated with or emerged from TA505. Additional reporting: This article is a flash briefing on the unconfirmed-vector claimed Shell data-theft incident (89GB), explicitly caveating that the specific intrusion method was not publicly confirmed at publication and that Shell was still scoping the breach. Clop's core differentiator vs. conventional ransomware actors is pure data-theft/extortion at platform-exploitation scale.

Also Known As

TA505FIN11 (partial overlap)DEV-0950Cl0pClop

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1041 Exfiltration Over C2 Channel T1486 Data Encrypted for Impact T1071 Application Layer Protocol T1059 Command and Scripting Interpreter T1567 Exfiltration Over Web Service

Intelligence Reports

Briefing critical-infrastructurefinance

Clop Claims Shell Data Exfiltration: 89GB of Energy Sector Data at Risk

Clop has claimed responsibility for stealing 89GB of data from Shell, with the energy major now investigating a 'potential incident'. The claim follows Clop's established pattern of mass data theft through file transfer platform vulnerabilities, with the group's latest campaign affecting multiple sectors simultaneously.

15 Aug 2026 · 3 min read
Analysis financegovernment

Cl0p: The Group That Turned File Transfer Vulnerabilities Into a Mass Exploitation Business

Cl0p is a financially motivated cybercriminal group that has systematically identified and mass-exploited zero-day vulnerabilities in enterprise file transfer software, compromising thousands of organisations globally. Their MOVEit campaign in 2023 was the largest data theft operation in the history of ransomware. This deep dive covers their operational model, technical approach, and what comes next.

4 Jun 2026 · 11 min read
Briefing transport

Cl0p Exploiting File Transfer Vulnerabilities Across Transport and Logistics Sector

The Cl0p ransomware group is mass-exploiting a newly disclosed vulnerability in a widely used managed file transfer platform. Several European freight and logistics operators have been impacted, with customs and supply chain data exfiltrated.

29 Apr 2026 · 3 min read