Loading story…
Ukrainian authorities, working with law enforcement partners in the United States and South Korea, arrested six suspected members of the Clop ransomware operation and conducted 21 searches in Kyiv and surrounding areas. Investigators said they seized computers, smartphones, server equipment, cash, and luxury vehicles, and shut down infrastructure allegedly used in earlier attacks. The suspects were reported to face prison terms of up to eight years if convicted.
The action targeted a group tied to ransomware and data-extortion attacks dating back to 2019, including incidents involving South Korean companies and the attack on retailer E-Land. Reporting also linked Clop to the exploitation of four zero-day vulnerabilities in Accellion FTA, intrusions that led to data theft and extortion affecting organizations including Kroger, Jones Day, Qualys, Singtel, Stanford University Medical School, the University of California, and the University of Maryland. Researchers and investigators have described Clop as a major double-extortion operation, though some assessments said the raids likely disrupted affiliates and money-laundering elements more than the group’s core leadership.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
A FireEye report said the Clop gang appeared to have struck a deal with FIN11. According to the report, FIN11 operators were allowed to list data stolen from hacked Accellion FTA devices.
A Fox-IT report said the Clop gang had close ties to malware distribution group TA505. The report added that TA505 often enabled Clop deployments on systems previously infected with SDBbot malware.
South Korean police intensified their investigation after Clop infected e-commerce giant E-Land. The attack forced the company to close almost half of its stores.
The references state that Clop ransomware incidents had been documented as early as February 2019, marking the group's emergence. Krebs also describes CLOP as debuting in early 2019.
Investigations later tied to the Ukrainian arrests began in 2019 after the Clop gang breached four South Korean companies, encrypted their files, and demanded large ransom payments. This incident became an early anchor for the multinational investigation.
Ukrainian authorities, working with law enforcement from South Korea and the United States, arrested six alleged Clop members. The operation included 21 searches in Kyiv and nearby regions, seizure of cash, devices, and luxury vehicles, and the shutdown of server infrastructure allegedly used in past attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourcetherecord.media
Open sourcekrebsonsecurity.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
Ukrainian, French, and U.S. authorities disrupted the **Egregor** ransomware operation through coordinated raids in Ukraine that led to the arrest of three suspected members and targeted alleged ring leaders and affiliate associates. Investigators linked the case to attacks on French organizations including **Ubisoft**, **Gefco**, and **Ouest France**, while Ukrainian officials said Egregor had struck more than **150 companies** and caused losses exceeding **$80 million**. After the operation, Egregor’s leak site went offline, indicating a major blow to the group, which researchers and investigators have also tied to the former **Maze** ransomware ecosystem. In a parallel international action, the U.S. Department of Justice announced a global disruption of **NetWalker**, another ransomware-as-a-service operation, charging Canadian national **Sebastien Vachon-Desjardins**, seizing about **$454,530** in cryptocurrency, and taking down a dark web site used to communicate with victims. The DOJ said NetWalker hit healthcare providers, municipalities, schools, universities, law enforcement, and emergency services, with healthcare organizations particularly targeted during the COVID-19 pandemic. French investigators said ransomware cases remain difficult because attackers move faster than judicial processes, forcing police to rely on infrastructure mapping, indicators of compromise, and private-sector intelligence to identify operators and support cross-border takedowns.
Aug 15, 2026
Romanian authorities arrested two suspected **Sodinokibi/REvil** affiliates as part of **Operation GoldDust**, a multinational law-enforcement campaign targeting operators tied to both REvil and **GandCrab**. Europol said the suspects were linked to roughly **5,000 infections** and about **€500,000** in ransom payments, while the broader group of arrested affiliates was suspected of around **7,000 infections** and demands exceeding **€200 million**. Since February 2021, authorities in 17 countries, working with **Europol**, **Eurojust**, and **INTERPOL**, had arrested seven suspects connected to the two ransomware families, including a REvil affiliate associated with the **Kaseya** supply-chain attack and other suspects detained in South Korea and Kuwait. The arrests followed wider pressure on REvil’s ransomware-as-a-service operation after its infrastructure was disrupted and its public-facing sites went offline. Reporting indicated the gang shut down after **U.S. Cyber Command** hijacked one of its sites and the operators realized they had been compromised, adding to the strain from coordinated international investigations. Europol said private-sector partners including **Bitdefender**, **KPN**, and **McAfee Enterprise** supported the operation with technical analysis and decryptors distributed through **No More Ransom**, enabling more than **50,000 decryptions**, helping over **1,400 companies** recover from REvil infections, and preventing losses worth hundreds of millions of euros.
Jun 29, 2026