RU

Clop

High ConfidenceCritical Threat

Cl0p • TA505 • FIN11 • GOLD TAHOE

Clop is a ransomware operation that has been active since at least 2019, known for their double extortion tactics and high-profile supply chain attacks. The group gained significant notoriety for exploiting zero-day vulnerabilities in file transfer solutions including Accellion FTA, GoAnywhere MFT, and MOVEit Transfer, affecting hundreds of organizations in single campaigns. Clop's operations have resulted in billions of dollars in damages and the exposure of sensitive data from government agencies, healthcare organizations, and financial institutions worldwide.

Origin: Russia
Sponsor: Cybercriminal (No State Sponsor)
Active: 2019 - Present
Victims: 3000+ organizations (MOVEit alone)
Advanced
Active
Financial Gain
Risk Assessment
86
Composite Risk Score
Critical Risk
ARCS Compliance90
Escalation Risk88
Grievance Index75
Infrastructure Impact92
History & Evolution

Clop is a ransomware operation that has been active since at least 2019, known for their double extortion tactics and high-profile supply chain attacks. The group gained significant notoriety for exploiting zero-day vulnerabilities in file transfer solutions including Accellion FTA, GoAnywhere MFT, and MOVEit Transfer, affecting hundreds of organizations in single campaigns. Clop's operations have resulted in billions of dollars in damages and the exposure of sensitive data from government agencies, healthcare organizations, and financial institutions worldwide.

Targeting

Target Sectors

All SectorsGovernmentHealthcareFinancial Services

Target Regions

Global
Attribution & Affiliations

Attributed to Cybercriminal (No State Sponsor) (Russia). Attribution confidence: High.

Intelligence Assessment
Critical
Threat Level
Moderately
Targeting
Moderately
Adaptability
Very High
Persistence
Continuous
Op Tempo
Active
Status

Future Outlook

Clop is expected to continue operations targeting All Sectors.

Timeline of Key Events
2019
Major

First observed activity of Clop

2024
Moderate

Continued active operations