clop
ransomware group · aka Clop, Cl0p, TA505, FIN11 (related tracking, Mandiant), Lace Tempest (Microsoft) · Russia (widely assessed as Russian-speaking; exact attribution unknown) · active since 2019 (Clop ransomware); precursor TA505/FIN11 activity tracked since 2016
Victims · 7d
0▼2
Victims · 30d
2active targets
Victims · 90d
90
All-time (tracked)
2.3Ksince 2021-09-09
Last post
09-10 01:43UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Clop (Cl0p) is a Russian-speaking data-extortion group long associated with the TA505 and FIN11 actor designations, known for high-volume extortion built on data theft rather than file encryption. The group is best known for mass exploitation of managed file transfer products: Accellion FTA (2020-21), SolarWinds Serv-U (2021), Fortra GoAnywhere (2023), Progress MOVEit (2023), Cleo (2024), and Oracle E-Business Suite (2025), affecting thousands of organizations. Its playbook combines SQL injection and webshell exploitation for initial access, large-scale exfiltration, leak-site listings, and mass email extortion campaigns aimed at victims' customers and partners. Public impact tallies (Emsisoft, 2023) counted 2,700+ organizations affected in the MOVEit campaign, but a confirmed aggregate earnings figure has not been published. Leak-site tracking on this dashboard shows continued activity, with 2 posts in the past 7 days (HENRYPRATT.COM, HARLEY-DAVIDSON.COM) as of 2026-09-10.
Tactics & tooling
- Mass exploitation of internet-facing managed file transfer software (MOVEit, GoAnywhere, Accellion FTA, Serv-U, Cleo, Oracle EBS)
- Exfiltration-first extortion: data theft without encryption; victims published on the Cl0p leak site
- SQL injection and webshell deployment in file-transfer intrusions (e.g., MOVEit human2.aspx webshell)
- Mass email extortion campaigns sent to victims' customers and partners to amplify pressure
- Historic spearphishing with macro-enabled Office documents for initial access (TA505-era)
- Use of rclone for bulk exfiltration reported in some file-transfer campaigns
- Ransomware deployment (Clop) in some intrusions, though major campaigns since 2023 are largely encryption-free
- Public deadlines on leak-site listings to pressure negotiations
Targeted sectors
Financial servicesInsuranceHealthcareGovernmentEducationEnergyManufacturingLegal
Notable public victims
Shell (Accellion FTA, 2020-21; MOVEit, 2023), Deloitte (MOVEit, 2023), Sony Interactive Entertainment (MOVEit, 2023), US Department of Energy (MOVEit, 2023), British Airways and BBC (via payroll provider Zellis, GoAnywhere campaign, 2023), Community Health Systems (GoAnywhere, 2023), New Zealand Stock Exchange (Accellion FTA, 2020), Singing River Health System (Accellion FTA, 2020-21), Harley-Davidson (listed on Cl0p leak site)
Estimated earnings
No public figure.
Leak-site victims2,302 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| JCWHITE.COM FILES PART1 - 10.1.90.172, [email protected], PC421, PC422, PC434 PUB | · Dec 22, 2021 | — |
| DUTTONFIRM.COM FILES PART1 - 10.1.5.92, 10.1.5.93, 10.1.5.99, 10.1.5.102, 10.1.5.114 PUBLI | · Dec 22, 2021 | — |
| SLIMSTOCK.COM FILES PART8 - 10.50.10.98, 10.50.10.162, 10.64.10.12, 10.64.10.13, 10.64.10. | · Dec 22, 2021 | — |
| MTMRECOGNITION.COM FILES PART4 - 10.0.1.18\ART, Assembly Blue, ce-files, credit PUBLISHED | · Dec 22, 2021 | — |
| SSMSJUSTICE.COM FILES PART9 - 192.168.1.250\D\DOCUMENTS\CIVIL\Horton, Michelle\Discovery\D | · Dec 22, 2021 | — |
| QUANTUMGROUP.COM FILES PART7 - QUANTUM FTPLP03V\Quantum FTP\ PUBLISHED | · Dec 22, 2021 | — |
| EDAN.COM FILES PART5 - 192.168.2.6\E$\人力资源组文件\个人\2.李丹, 杨澜 PUBLISHED | · Dec 22, 2021 | — |
| BOLTONUSA.COM FILES PART10 - 10.0.0.20\c$\BOD_HQ_CIFS\BPNE\client files\ PUBLISHED | · Dec 22, 2021 | — |
| ABSOLUTERESULTS.COM FILES PART10 - E\FTP Directory\DealerTrack Archive\ PUBLISHED | · Dec 22, 2021 | — |
| STRATISVISUALS.COM FILES PART13 - C\FTP\stratis\ PUBLISHED | · Dec 22, 2021 | — |
| SWIRESPO.COM FILES PART5 - PST\[email protected], [email protected] | · Dec 22, 2021 | — |
| ENPRECIS.COM FILES PART3 - 10.50.11.4\Developers_VX, Public PUBLISHED | · Dec 22, 2021 | — |
| SSMSJUSTICE.COM FILES PART8 - 192.168.1.250\D\DOCUMENTS\CIVIL\Environmental Justice...Hern | · Dec 18, 2021 | — |
| MTMRECOGNITION.COM FILES PART3 - 10.0.12.108, 10.0.0.40 PUBLISHED | · Dec 18, 2021 | — |
| DACOLL.CO.UK FILES PART12 - 172.21.240.103\user3\ACCOUNTS\Shared Folders\MAINT...SL PUBLIS | · Dec 18, 2021 | — |
| SLIMSTOCK.COM FILES PART7 - 10.30.11.194, 10.30.12.35, 10.30.15.2, 10.30.16.2, 10.31.1.100 | · Dec 18, 2021 | — |
| QUANTUMGROUP.COM FILES PART6 - QUANTUM FTPLP03V\Quantum FTP\ais\NSCBatch PUBLISHED | · Dec 18, 2021 | — |
| MCH-GROUP.COM FILES PART5 - 172.16.60.11\ACAD_ZEI\Infrastruktur\MZK PUBLISHED | · Dec 18, 2021 | — |
| EDAN.COM FILES PART4 - 192.168.2.6\E$\人力资源组文件\个人\唐羽,李少静 PUBLISHED | · Dec 18, 2021 | — |
| BOLTONUSA.COM FILES PART9 - 10.0.0.20\c$\BOD_HQ_CIFS\BPNE\client files\ PUBLISHED | · Dec 18, 2021 | — |
| ABSOLUTERESULTS.COM FILES PART9 - E\FTP Directory\DealerTrack Archive\ PUBLISHED | · Dec 18, 2021 | — |
| STRATISVISUALS.COM FILES PART12 - C\FTP\stratis\Dollar General Frito Lay Strips -Ready To | · Dec 18, 2021 | — |
| SWIRESPO.COM FILES PART4 - Personal Folders-P167, P171, P174, P177, [email protected] | · Dec 18, 2021 | — |
| ENPRECIS.COM FILES PART2 - 10.50.1.4, 10.50.21.4, 10.50.31.4, 10.51.21.7, 10.51.122.6, 10. | · Dec 18, 2021 | — |
| SSMSJUSTICE.COM FILES PART7 - 192.168.1.250\D\DOCUMENTS\CIVIL\Almahmodi, Hassan...Dutton, | · Dec 15, 2021 | — |
| SLIMSTOCK.COM FILES PART6 - 10.30.12.34, 10.30.14.66 PUBLISHED | · Dec 15, 2021 | — |
| MTMRECOGNITION.COM FILES PART2 - 10.0.4.228 PUBLISHED | · Dec 15, 2021 | — |
| DACOLL.CO.UK FILES PART11 - 172.21.240.103\user3\ACCOUNTS\Shared Folders\Access...KF quart | · Dec 15, 2021 | — |
| MCH-GROUP.COM FILES PART4 - 173.16.60.11\ACAD_ZEI!MesseCad...User PUBLISHED | · Dec 15, 2021 | — |
| QUANTUMGROUP.COM FILES PART5 - QUANTUM FTPLP03V\Quantum FTP\ais\ATT Invoice...Test PUBLISH | · Dec 15, 2021 | — |
| EDAN.COM FILES PART3 - 192.168.2.6\E$\国际营销系统共享文件,跟单组文件 PUBLISHED | · Dec 15, 2021 | — |
| TONLYELE.COM FILES PART7 - 10.84.130.219\E$\FTP __ 10.84.130.123\caiwugx_test PUBLISHED | · Dec 15, 2021 | — |
| BOLTONUSA.COM FILES PART8 - 10.0.0.20\c$\BOD_HQ_CIFS\BPNE\other PUBLISHED | · Dec 15, 2021 | — |
| ABSOLUTERESULTS.COM FILES PART8 - E\FTP Directory\FTPARCC...PrinterFilesPurged PUBLISHED | · Dec 15, 2021 | — |
| STRATISVISUALS.COM FILES PART11 - C\FTP\stratis\Ready To PRINT-CT...Wakefern Weekly PUBLIS | · Dec 15, 2021 | — |
| SWIRESPO.COM FILES PART3 - PST\210421AndBefore...Personal Folders-P165 PUBLISHED | · Dec 15, 2021 | — |
| ENPRECIS.COM FILES PART1 - mails PUBLISHED | · Dec 15, 2021 | — |
| MTMRECOGNITION.COM FILES PART1 - mbox PUBLISHED | · Dec 10, 2021 | — |
| SLIMSTOCK.COM FILES PART5 - 10.50.10.131, 10.50.10.196, 10.50.10.227, 10.50.10.229 PUBLIS | · Dec 10, 2021 | — |
| DACOLL.CO.UK FILES PART10 - 172.21.240.103/user3/Dacoll Electrical Ltd PUBLISHED | · Dec 10, 2021 | — |
| QUANTUMGROUP.COM FILES PART4 - nolanfinancial, opalwealthadvisors, shutterfly, sonic, spa | · Dec 10, 2021 | — |
| TONLYELE.COM FILES PART6 - 10.84.130.219\F$ PUBLISHED | · Dec 10, 2021 | — |
| BOLTONUSA.COM FILES PART7 - 10.0.0.20\c$\BOD_HQ_CIFS\HW_dept PUBLISHED | · Dec 10, 2021 | — |
| ABSOLUTERESULTS.COM FILES PART7 - E/FTP Directory PUBLISHED | · Dec 10, 2021 | — |
| EDAN.COM FILES PART2 - 192.168.2.6\E$ - 商务组文件, 客服组文件 PUBLISHED | · Dec 10, 2021 | — |
| MCH-GROUP.COM FILES PART3 - 173.16.60.11\DATEN PUBLISHED | · Dec 10, 2021 | — |
| STRATISVISUALS.COM FILES PART10 - C\FTP PUBLISHED | · Dec 10, 2021 | — |
| SWIRESPO.COM FILES PART2 -PST\[email protected], [email protected] P | · Dec 10, 2021 | — |
| SSMSJUSTICE.COM FILES PART6 - 192.168.1.250\D\DOCUMETS\CRIMINAL,HR-ACCT PUBLISHED | · Dec 10, 2021 | — |
| SLIMSTOCK.COM FILES FILES PART5 - 10.50.10.131, 10.50.10.196, 10.50.10.227, 10.50.10.229 | · Dec 9, 2021 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .