clop
ransomware group · aka Clop, Cl0p, TA505, FIN11 (related tracking, Mandiant), Lace Tempest (Microsoft) · Russia (widely assessed as Russian-speaking; exact attribution unknown) · active since 2019 (Clop ransomware); precursor TA505/FIN11 activity tracked since 2016
Victims · 7d
2▲2 vs prev. week
Victims · 30d
2active targets
Victims · 90d
90
All-time (tracked)
2.3Ksince 2021-09-09
Last post
09-10 01:43UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Clop (Cl0p) is a Russian-speaking data-extortion group long associated with the TA505 and FIN11 actor designations, known for high-volume extortion built on data theft rather than file encryption. The group is best known for mass exploitation of managed file transfer products: Accellion FTA (2020-21), SolarWinds Serv-U (2021), Fortra GoAnywhere (2023), Progress MOVEit (2023), Cleo (2024), and Oracle E-Business Suite (2025), affecting thousands of organizations. Its playbook combines SQL injection and webshell exploitation for initial access, large-scale exfiltration, leak-site listings, and mass email extortion campaigns aimed at victims' customers and partners. Public impact tallies (Emsisoft, 2023) counted 2,700+ organizations affected in the MOVEit campaign, but a confirmed aggregate earnings figure has not been published. Leak-site tracking on this dashboard shows continued activity, with 2 posts in the past 7 days (HENRYPRATT.COM, HARLEY-DAVIDSON.COM) as of 2026-09-10.
Tactics & tooling
- Mass exploitation of internet-facing managed file transfer software (MOVEit, GoAnywhere, Accellion FTA, Serv-U, Cleo, Oracle EBS)
- Exfiltration-first extortion: data theft without encryption; victims published on the Cl0p leak site
- SQL injection and webshell deployment in file-transfer intrusions (e.g., MOVEit human2.aspx webshell)
- Mass email extortion campaigns sent to victims' customers and partners to amplify pressure
- Historic spearphishing with macro-enabled Office documents for initial access (TA505-era)
- Use of rclone for bulk exfiltration reported in some file-transfer campaigns
- Ransomware deployment (Clop) in some intrusions, though major campaigns since 2023 are largely encryption-free
- Public deadlines on leak-site listings to pressure negotiations
Targeted sectors
Financial servicesInsuranceHealthcareGovernmentEducationEnergyManufacturingLegal
Notable public victims
Shell (Accellion FTA, 2020-21; MOVEit, 2023), Deloitte (MOVEit, 2023), Sony Interactive Entertainment (MOVEit, 2023), US Department of Energy (MOVEit, 2023), British Airways and BBC (via payroll provider Zellis, GoAnywhere campaign, 2023), Community Health Systems (GoAnywhere, 2023), New Zealand Stock Exchange (Accellion FTA, 2020), Singing River Health System (Accellion FTA, 2020-21), Harley-Davidson (listed on Cl0p leak site)
Estimated earnings
No public figure.
Leak-site victims2,302 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| HENRYPRATT.COM | · 5d ago | — |
| HARLEY-DAVIDSON.COM | · 5d ago | — |
| ZEBRA.COM | · Aug 13, 2026 | Data exfiltrated included the following: Database, Project - files, CAD - files Total size: 8Tb Revenue: $5,600,000,000 |
| NETPOWER.COM | · Aug 12, 2026 | Data exfiltrated included the following: Projects, Cad-files, Backup files Windchil Total size: 230Gb Revenue: $370,900,000 |
| SHELL.COM (August 2026) | · Aug 12, 2026 | Data exfiltrated included the following: Engineering drawings, photos of the facilities, scans of facility testing reports, project plans Total size: 89Gb Revenue: $2,673,000,000,000 |
| GE.COM | · Aug 12, 2026 | Data exfiltrated included the following: Software backups, system files, projects Total size: 391Gb Revenue: $113,000,000,000 |
| FISERV.COM | · Aug 12, 2026 | Data exfiltrated included the following: Projects, Cad-files, files Windchil, Soft Total size: 874Gb Revenue: $21,200,000,000 |
| PHILIPS.COM | · Aug 12, 2026 | Data exfiltrated included the following: PDF drawings, diagrams, blueprints Total size: 13.5Gb Revenue: $20,700,000,000 |
| ALDOGROUP.COM (ALDOSHOES.COM) | · Aug 12, 2026 | Data exfiltrated included the following: TSV files, soft, Projects, Cad-files Total size: 424Gb Revenue: $14,800,000,000 |
| IRCO.COM | · Aug 12, 2026 | Data exfiltrated included the following: Cad-files, PDF drawings, diagrams, product presentations, specifications, manuals and instructions Total size: 5564Gb Revenue: $7,800,000,000 |
| TOASTTAB.COM | · Aug 12, 2026 | Data exfiltrated included the following: project, backup database, logs Total size: 215Gb Revenue: $6,400,000,000 |
| LARGAN.COM.TW | · Aug 12, 2026 | Data exfiltrated included the following: Project, Soft Total size: 56Gb Revenue: $1,700,000,000 |
| STARKEY.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project Total size: 3030Gb Revenue: $939,200,000 |
| PARTECH.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project, Cad-files, Backups Total size: 24Gb Revenue: $475,700,000 |
| MAMMUT.COM | · Aug 12, 2026 | Data exfiltrated included the following: .png files, files Windchil Total size: 136Gb Revenue: $281,000,000 |
| CORNELIUS.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project, PDF, TXT, DOC - files Total size: 3684Gb Revenue: $269,800,000 |
| MAMASANDPAPAS.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1,18Gb Revenue: $131,000,000 |
| TRISTAR.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1579,9Gb Revenue: $1,000,000,000 |
| SMAPCENTER.UAH.EDU | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 6,08Gb Revenue: $113,000,000 |
| SUUNTO.CN (SUUNTO.COM) | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1470Gb Revenue: $111,000,000 |
| BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 22,4Gb Revenue: $100,000,000 |
| JPMGROUP.CO.IN | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 75,4Gb Revenue: $400,000,000 |
| CLOVER.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 651Gb Revenue: $400,000,000 |
| ATOMBERG.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 980Gb Revenue: $68,000,000 |
| HONGHE-TECH.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1,588Gb Revenue: $470,000,000 |
| INTELLIGENTGROWTHSOLUTIONS.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project, PDF, XLSX, XLS, DOCX - files Total size: 261Gb Revenue: $31,000,000 |
| INTELLIHOT.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Backups, Soft installers, Updates, XML - files Total size: 271Gb Revenue: $27,000,000 |
| 9ALTITUDES.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Project Backups, SQL Database Backup Total size: 382Gb Revenue: $15,000,000 |
| WATERLANDPE.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Project Backups, SQL Database Backup Total size: 382Gb Revenue: $5,800,000 |
| THERMOS.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Soft installers Total size: 285Gb Revenue: $9,000,000 |
| NUOVACMM.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Soft installers Total size: 279Gb Revenue: $6,600,000 |
| IVALUESYS.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Backups Total size: 109Gb Revenue: $8,100,000 |
| SPKAA.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects Total size: 581Gb Revenue: $7,600,000 |
| LIFESTRAW.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, Backups, Logs, Soft installers, PDF, TXT, XML - files Total size: 168Gb Revenue: $200,000,000 |
| OMNITANKER.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects, SQL Backups, Soft installers, Jpeg, Png, PDF - files Total size: 83Gb Revenue: $10,000,000 |
| ARCHERGREY.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects Total size: 1,84Gb Revenue: <$5,000,000 |
| G3AEROSPACE.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects Total size: 319Gb Revenue: $1,000,000 |
| ITKHOLDING.HU | · Aug 12, 2026 | Data exfiltrated included the following: Database, Projects Total size: 40,7Gb Revenue: $1,700,000,000 |
| MIDLANDIND.COM.AU | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project Total size: 0.5Gb Revenue: $5,000,000 |
| FLUIDLOGIC.COM | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project,Cad-files Total size: 26.4Gb Revenue: $5,000,000 |
| QCPL.IN | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project Total size: 501Gb Revenue: $5,000,000 |
| STNET.IT | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project Total size: 13.2Gb Revenue: $5,000,000 |
| ECCELLENT.COM | · Aug 12, 2026 | Data exfiltrated included the following: DBF files, Cad-files, Project, Soft, Backups Total size: 241Gb Revenue: $5,000,000 |
| IPMSOLUTIONS.SK | · Aug 12, 2026 | Data exfiltrated included the following: PDF files, Cad-files, Soft Total size: 253Gb Revenue: $5,000,000 |
| NUVITIA.COM | · Aug 12, 2026 | Data exfiltrated included the following: Project, Soft Total size: 89.8Gb Revenue: $5,000,000 |
| CONTINENTAL.AERO | · Aug 7, 2026 | — |
| MINDRAY.COM | · Aug 7, 2026 | — |
| nuv******* | · Aug 5, 2026 | Data exfiltrated included the following: Project, Soft Total size: 89.8Gb Revenue: $5,000,000 |
| ipm******* | · Aug 5, 2026 | Data exfiltrated included the following: PDF files, Cad-files, Soft Total size: 253Gb Revenue: $5,000,000 |
| ecc******* | · Aug 5, 2026 | Data exfiltrated included the following: DBF files, Cad-files, Project, Soft, Backups Total size: 241Gb Revenue: $5,000,000 |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .