{
  "family": "clop",
  "sample_count": 140,
  "category": "ransomware",
  "description": "Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempest) that fundamentally transformed the cyber extortion landscape by pivoting from traditional endpoint encryption to catastrophic zero-day mass data exfiltration and extortion. Emerging around February 2019 as a variant of the CryptoMix ransomware family, Clop operated traditional double-extortion campaigns utilizing RSA-1024 and RC4 encryption to lock corporate servers while threatening to publish stolen records on their 'CL0P^_- LEAKS' portal. However, beginning in late 2020, Clop revolutionized its operational model by targeting enterprise Managed File Transfer (MFT) appliances using weaponized zero-day exploits. Clop executed successive automated mass-exploitation waves targeting Accellion FTA, Fortra GoAnywhere MFT (CVE-2023-0669), and culminating in the historic May 2023 zero-day attack on Progress Software MOVEit Transfer (CVE-2023-34362). In the MOVEit campaign, Clop exploited an unauthenticated pre-auth SQL injection vulnerability to drop custom 'human2.aspx' webshells across thousands of internet-facing enterprise file transfer servers, exfiltrating billions of sensitive records affecting over 2,700 organizations and 90 million individuals worldwide, including government agencies, universities, and healthcare providers. CISA, the FBI, and international partners released Advisory AA23-158A detailing Clop's exploitation of MOVEit Transfer vulnerabilities.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "Cl0p",
    "Clop Ransomware",
    "CryptoMix Clop",
    "TA505 Clop",
    "Lace Tempest"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Clop (Cl0p) ransomware and who operates it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clop is a cyber extortion syndicate operated by Russian threat group FIN11 (TA505 / Lace Tempest). It evolved from CryptoMix ransomware into the foremost practitioner of zero-day MFT mass-data exfiltration."
      }
    },
    {
      "@type": "Question",
      "name": "What happened during the May 2023 MOVEit Transfer mass exploitation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clop exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in MOVEit Transfer servers, deploying human2.aspx webshells to steal corporate file repositories from over 2,700 organizations globally."
      }
    },
    {
      "@type": "Question",
      "name": "Why did Clop pivot away from encrypting endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clop recognized that mass data theft from centralized file transfer appliances (MFTs) yields higher leverage, faster execution, and bypasses traditional endpoint detection systems without needing to encrypt local files."
      }
    },
    {
      "@type": "Question",
      "name": "What other MFT software has Clop exploited?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Prior to MOVEit, Clop executed zero-day mass-theft campaigns targeting Accellion FTA appliances in late 2020 and Fortra GoAnywhere MFT (CVE-2023-0669) in early 2023."
      }
    },
    {
      "@type": "Question",
      "name": "What guidance does CISA Advisory AA23-158A provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CISA Advisory AA23-158A outlines MOVEit IOCs, webshell signatures (human2.aspx), recommendations to immediately patch CVE-2023-34362, and steps to isolate vulnerable file transfer instances from the public internet."
      }
    },
    {
      "@type": "Question",
      "name": "How did CL0P exploit zero-day vulnerabilities in Accellion FTA, GoAnywhere MFT, and MOVEit Transfer (CVE-2023-34362)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CL0P (operated by FIN11 / Lace Tempest) shifted cyber extortion paradigms by weaponizing mass zero-day vulnerabilities in managed file transfer (MFT) platforms. They systematically exploited SQL injection vulnerabilities in Accellion FTA (December 2020), Fortra GoAnywhere MFT (CVE-2023-0669 in February 2023), and Progress MOVEit Transfer (CVE-2023-34362 in May 2023) to steal multi-terabyte datasets from hundreds of organizations simultaneously without needing to deploy file-encrypting payloads."
      }
    },
    {
      "@type": "Question",
      "name": "What data exfiltration tools and Torrent seeding infrastructure did CL0P deploy for double extortion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "During its MOVEit campaign, CL0P deployed custom webshells (LEMURLOOT) to extract relational database tables, Azure cloud credentials, and file stores. Due to massive multi-terabyte leak volumes overwhelming Tor network bandwidth, CL0P established clear-web BitTorrent trackers and magnet links to facilitate rapid decentralized downloading of leaked victim archives."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1190",
    "T1505.003",
    "T1041",
    "T1486",
    "T1059.001",
    "T1003.001",
    "T1021.002"
  ],
  "cisa_advisory": "AA23-158A",
  "exploited_cves": [
    "CVE-2023-34362",
    "CVE-2023-0669"
  ],
  "iocs": {
    "file_hashes": [
      "31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad",
      "b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025",
      "9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420"
    ],
    "delivery": [
      "Pre-authentication SQL injection exploitation of MOVEit Transfer web applications (CVE-2023-34362)",
      "Remote code execution against Fortra GoAnywhere MFT appliances (CVE-2023-0669)",
      "Spear-phishing campaigns delivering weaponized Office documents dropping Cobalt Strike or TrueBot"
    ],
    "persistence": [
      "Deployment of human2.aspx webshells inside MOVEit Transfer wwwroot web directories",
      "Creation of rogue administrative user accounts in backend application SQL databases",
      "Scheduled tasks executing PowerShell exfiltration scripts"
    ]
  },
  "lineage": {
    "derived_from": [
      "cryptomix"
    ],
    "variants": [
      "clop_v1",
      "clop_moveit_stealer",
      "clop_goanywhere"
    ]
  },
  "ecosystem": [
    "windows",
    "windows_pe",
    "web_servers"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion",
    "collection",
    "exfiltration",
    "impact"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "CISA Advisory AA23-158A: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a"
    },
    {
      "name": "Mandiant: Threat Actor TA505 / FIN11 Exploitation of MOVEit Transfer",
      "url": "https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft"
    },
    {
      "name": "Microsoft Threat Intelligence: Analysis of MOVEit Transfer Zero-Day Exploitation",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/06/07/analysis-of-moveit-transfer-zero-day-exploitation/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}