Loading story…
The Clop ransomware and data-extortion operation has been linked to the TA505 ecosystem and has targeted organizations since 2019 through a mix of spear-phishing, stolen or compromised RDP credentials, and exploitation of internet-facing applications. Reporting on the group describes a shift from conventional ransomware deployment toward large-scale data theft and extortion, with victims pressured through leak-site exposure after sensitive information was exfiltrated.
Clop has been repeatedly tied to attacks on managed file transfer software, including Accellion FTA, GoAnywhere MFT, and MOVEit Transfer. In the MOVEit campaign, attackers exploited a SQL injection flaw, deployed the LEMURLOOT web shell, and stole data from backend databases; broader intrusion activity associated with the group has also included PowerShell execution, privilege escalation, process injection, Cobalt Strike command-and-control, persistence via web shells, and encryption for impact in some cases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
In June 2023, multiple organizations were reported compromised in Clop's MOVEit campaign, including U.S. federal agencies, the BBC, hospitals, and EY. This represents a major expansion in disclosed victims and impact.
In April 2022, researchers found several MOVEit Transfer servers compromised and containing sensitive information. The reference ties this to Clop's exploitation of the platform and data theft activity.
The timeline says that in November 2021, researchers observed Clop exploiting a SolarWinds vulnerability to breach several organizations. This marks a reported technical development in the group's intrusion methods.
In November 2021, maritime services in Singapore were hit by Clop, with commercial and employee bank data exfiltrated. The event is described as a specific victim-sector intrusion with theft of sensitive information.
The reference states that since late 2020, Clop threat actors have compromised over 100 companies. It presents this as a broader escalation in victim count tied to the group's campaigns.
In April 2020, Clop actors accessed a pharmaceutical company and leaked user data. This reflects an extortion-focused incident rather than only encryption activity.
The timeline states that in January 2020, Fin11 deployed Clop ransomware against Kiteworks Accellion FTA. The broader profile links Clop and Fin11 to exploitation of Accellion FTA zero-day vulnerabilities.
Clop ransomware was first noticed in the wild during large-scale spear-phishing activity. The reference describes this as the earliest observed appearance of the threat.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
Attackers exploited vulnerabilities in the legacy **Accellion File Transfer Appliance (FTA)** and deployed a file-downloading web shell to steal data from organizations worldwide, triggering breaches at telecom, legal, financial, and other enterprises. Reporting tied the campaign to the **Clop** ransomware operation, with additional analysis suggesting overlap with **FIN11**, as victims including **Singtel** and a global law firm said their incidents stemmed from compromise at the file-sharing provider rather than direct intrusion into their own networks. The intrusions were followed by aggressive extortion, including public leak threats and, in at least one case, the exposure of bank employee personal data to pressure payment. Subsequent government warnings said cybersecurity agencies had observed active exploitation of Accellion vulnerabilities, reinforcing the incident as part of Clop’s broader pattern of targeting managed file transfer products to conduct large-scale data theft and shaming-based extortion rather than relying solely on encryption.
Jun 29, 2026
The **Cl0p** ransomware operation used data stolen through the Accellion File Transfer Appliance compromise to extort dozens of organizations, escalating pressure by emailing victims’ customers directly and threatening publication on its **CL0P^-LEAKS** site. Reporting and threat research describe a highly organized group that demanded multimillion-dollar payments, offered time-based discounts, and in some cases removed victims from its leak portal after payment, while uncertainty remained over whether Cl0p conducted the initial Accellion intrusion or primarily monetized the stolen data. Security researchers linked Cl0p to **TA505/FIN11** activity, citing years of overlapping phishing, malware delivery, and ransomware deployment patterns. Prior campaigns used mass email lures, malicious Excel **XLM macros**, custom packers, and tailored Cl0p binaries compiled per victim with unique RSA keys and individualized ransom notes, suggesting direct operator control rather than a typical affiliate-only model. Analysts also noted Tor-based negotiation portals, double-extortion tactics combining encryption with data theft, and operational patterns consistent with a mature financially motivated criminal enterprise believed to avoid infecting systems configured for Russian or other CIS language settings.
Aug 15, 2026