clop
ransomware group · aka Clop, Cl0p, TA505, FIN11 (related tracking, Mandiant), Lace Tempest (Microsoft) · Russia (widely assessed as Russian-speaking; exact attribution unknown) · active since 2019 (Clop ransomware); precursor TA505/FIN11 activity tracked since 2016
Victims · 7d
0▼2
Victims · 30d
2active targets
Victims · 90d
90
All-time (tracked)
2.3Ksince 2021-09-09
Last post
09-10 01:43UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Clop (Cl0p) is a Russian-speaking data-extortion group long associated with the TA505 and FIN11 actor designations, known for high-volume extortion built on data theft rather than file encryption. The group is best known for mass exploitation of managed file transfer products: Accellion FTA (2020-21), SolarWinds Serv-U (2021), Fortra GoAnywhere (2023), Progress MOVEit (2023), Cleo (2024), and Oracle E-Business Suite (2025), affecting thousands of organizations. Its playbook combines SQL injection and webshell exploitation for initial access, large-scale exfiltration, leak-site listings, and mass email extortion campaigns aimed at victims' customers and partners. Public impact tallies (Emsisoft, 2023) counted 2,700+ organizations affected in the MOVEit campaign, but a confirmed aggregate earnings figure has not been published. Leak-site tracking on this dashboard shows continued activity, with 2 posts in the past 7 days (HENRYPRATT.COM, HARLEY-DAVIDSON.COM) as of 2026-09-10.
Tactics & tooling
- Mass exploitation of internet-facing managed file transfer software (MOVEit, GoAnywhere, Accellion FTA, Serv-U, Cleo, Oracle EBS)
- Exfiltration-first extortion: data theft without encryption; victims published on the Cl0p leak site
- SQL injection and webshell deployment in file-transfer intrusions (e.g., MOVEit human2.aspx webshell)
- Mass email extortion campaigns sent to victims' customers and partners to amplify pressure
- Historic spearphishing with macro-enabled Office documents for initial access (TA505-era)
- Use of rclone for bulk exfiltration reported in some file-transfer campaigns
- Ransomware deployment (Clop) in some intrusions, though major campaigns since 2023 are largely encryption-free
- Public deadlines on leak-site listings to pressure negotiations
Targeted sectors
Financial servicesInsuranceHealthcareGovernmentEducationEnergyManufacturingLegal
Notable public victims
Shell (Accellion FTA, 2020-21; MOVEit, 2023), Deloitte (MOVEit, 2023), Sony Interactive Entertainment (MOVEit, 2023), US Department of Energy (MOVEit, 2023), British Airways and BBC (via payroll provider Zellis, GoAnywhere campaign, 2023), Community Health Systems (GoAnywhere, 2023), New Zealand Stock Exchange (Accellion FTA, 2020), Singing River Health System (Accellion FTA, 2020-21), Harley-Davidson (listed on Cl0p leak site)
Estimated earnings
No public figure.
Leak-site victims2,302 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| DACOLL.CO.UK FILES FILES PART10 - 172.21.240.103/user3/Dacoll Electrical Ltd PUBLISHED | · Dec 9, 2021 | — |
| QUANTUMGROUP.COM FILES FILES PART4 - nolanfinancial, opalwealthadvisors, shutterfly, soni | · Dec 9, 2021 | — |
| TONLYELE.COM FILES FILES PART6 - 10.84.130.219\F$ PUBLISHED | · Dec 9, 2021 | — |
| SLIMSTOCK.COM FILES PART3 PUBLISHED | · Dec 9, 2021 | — |
| BOLTONUSA.COM FILES FILES PART7 - 10.0.0.20\c$\BOD_HQ_CIFS\HW_dept PUBLISHED | · Dec 9, 2021 | — |
| ABSOLUTERESULTS.COM FILES FILES PART7 - E/FTP Directory PUBLISHED | · Dec 9, 2021 | — |
| EDAN.COM FILES FILES PART2 - 192.168.2.6\E$ - 商务组文件, 客服组文件 PUBLISHED | · Dec 9, 2021 | — |
| SWIRESPO.COM FILES PART1 PUBLISHED | · Nov 26, 2021 | — |
| EDAN.COM FILES PART1 - 192.168.2.6\D$ - IM-PAYMENT, 国际市场传播, 国际营销系统超声部, 报价单, 行政组文件 PUBLISH | · Nov 25, 2021 | — |
| GENESISNET.COM FILES PART8 - 10.0.70.121\ATS_FILESHARE\Project_Management** PUBLISHED | · Nov 16, 2021 | — |
| GENESISNET.COM FILES PART19 - 10.16.16.40\G$\GNIS\GNIS-Accounting PUBLISHED | · Nov 8, 2021 | — |
| QUANTUMGROUP.COM FILES PART3 - ladderlife, livelifecapital, lob, mmg, NJCPA PUBLISHED | · Nov 8, 2021 | — |
| NATUS.COM FILES PART3 - siebelsfdc, shepler, retcamDHR, hcmfusion PUBLISHED | · Nov 8, 2021 | — |
| SMARTERASP.NET FILES PART3+4 FINAL PUBLISHED | · Nov 8, 2021 | — |
| TONLYELE.COM FILES PART5 - MT工程文件, SMT2工程组 PUBLISHED | · Nov 8, 2021 | — |
| BOLTONUSA.COM FILES FILES PART6 - 10.0.0.20\c$\BOD_HQ_CIFS PUBLISHED | · Nov 8, 2021 | — |
| MCH-GROUP.COM FILES FILES PART2 - 172.16.60.11\FILESERVICE$ PUBLISHED | · Nov 8, 2021 | — |
| ABSOLUTERESULTS.COM FILES FILES PART6 - 10.50.0.1 PUBLISHED | · Nov 8, 2021 | — |
| STRATISVISUALS.COM FILES FILES PART9 - FINAL PUBLISHED | · Nov 8, 2021 | — |
| SLIMSTOCK.COM FILES FILES PART3 PUBLISHED | · Nov 8, 2021 | — |
| BRPRINTERS.COM FILES PART13 - 172.10.20.24\users$ PUBLISHED | · Nov 8, 2021 | — |
| SSMSJUSTICE.COM FILES FILES PART5 - 192.168.1.250\D\DATA PUBLISHED | · Nov 8, 2021 | — |
| DACOLL.CO.UK FILES PART8 172.21.240.103\NASPOFFICIAL\2020\NASP 4th Cycle PUBLISHED | · Nov 8, 2021 | — |
| BPATPA.COM FILES PART14 PUBLISHED | · Nov 8, 2021 | — |
| STRATISVISUALS.COM FILES FILES PART8 - MCCOY021\DigitalPrintFiles PUBLISHED | · Nov 6, 2021 | — |
| BRPRINTERS.COM FILES PART12 - 172.10.20.24\users$ PUBLISHED | · Nov 6, 2021 | — |
| SLIMSTOCK.COM FILES FILES PART2 - 10.30.10.131, 10.30.10.226, 10.30.11.34, 10.30.11.130 P | · Nov 6, 2021 | — |
| SSMSJUSTICE.COM FILES FILES PART4 - 192.168.1.250\D\DATA\Case Files PUBLISHED | · Nov 6, 2021 | — |
| DACOLL.CO.UK FILES 172.21.240.103\NASPOFFICIAL\2020 PUBLISHED | · Nov 6, 2021 | — |
| BPATPA.COM FILES PART13 PUBLISHED | · Nov 6, 2021 | — |
| ENESCO.COM FILES FILES PART1 - Chase, Creative\Rainbow Mountain PUBLISHED | · Nov 6, 2021 | — |
| BOLTONUSA.COM FILES FILES PART5 - 10.0.0.20\c$\BOD_HQ_CIFS PUBLISHED | · Nov 6, 2021 | — |
| EMPIRICAL-RESEARCH.COM FILES FILES PART10+11 PUBLISHED | · Nov 6, 2021 | — |
| ABSOLUTERESULTS.COM FILES FILES PART5 - 10.21.0.20, 10.21.0.51, 10.21.201.23, G PUBLISHED | · Nov 6, 2021 | — |
| TONLYELE.COM FILES PART4 - TWS, TWS产线文件, TWS部门公用临时文件夹, 三楼采购扫描 PUBLISHED | · Nov 6, 2021 | — |
| SMARTERASP.NET FILES PART2 - SERVER WIN5136 PUBLISHED | · Nov 6, 2021 | — |
| MCH-GROUP.COM FILES FILES PART1 - Mail CASPAR_HIRZEL_DEZ2012-DEZ15.pst, DFaber_Archiv.pst | · Nov 6, 2021 | — |
| NATUS.COM FILES PART2 - HUMANRESOURCES PUBLISHED | · Nov 6, 2021 | — |
| QUANTUMGROUP.COM FILES PART1- equityadvisorsolutions, gallagher, google, healthgrades, hh | · Nov 6, 2021 | — |
| GENESISNET.COM FILES PART17+18 PUBLISHED | · Nov 6, 2021 | — |
| SUNSETHCS.COM FILES FILES PART13 - FINAL PUBLISHED | · Oct 27, 2021 | — |
| QUANTUMGROUP.COM FILES PART1- Abbvie, abbviekeystone, achn, adarling, alight, cerity, dat | · Oct 27, 2021 | — |
| TONLYELE.COM FILES PART2 - 通力电子共享服务器, 采购SRM培训教材, 陈江二厂3楼扫描 PUBLISHED | · Oct 27, 2021 | — |
| TONLYELE.COM FILES PART3 - 二楼DQA扫描, 技术创新部, 通力尽调 PUBLISHED | · Oct 27, 2021 | — |
| BOLTONUSA.COM FILES FILES PART4 - E PUBLISHED | · Oct 27, 2021 | — |
| ABSOLUTERESULTS.COM FILES FILES PART4 - F$, H$, H PUBLISHED | · Oct 27, 2021 | — |
| SMARTERASP.NET FILES PART2 - SERVER WIN5018 PUBLISHED | · Oct 27, 2021 | — |
| NATUS.COM FILES PART1- smosley, swendt PUBLISHED | · Oct 27, 2021 | — |
| STRATISVISUALS.COM FILES FILES PART7 - MCCOY004, MCCOY016 PUBLISHED | · Oct 27, 2021 | — |
| BRPRINTERS.COM FILES PART11 - 172.10.20.24\users$ PUBLISHED | · Oct 27, 2021 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .