Clop

Description

Clop is a ransomware operation associated with the FIN11 threat group that conducts large scale data theft and extortion campaigns. Its operators exploit file transfer software, managed file transfer appliances, and other server side vulnerabilities to breach organizations at scale, and they extort victims through a leak site. The family has run mass exploitation campaigns that rank among the most disruptive in recent years, affecting thousands of downstream organizations through a single supplier breach.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

17 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.007Msiexec
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0007 Discovery

T1057Process Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1112Modify Registry
T1553Subvert Trust Controls
- T1553.002Code Signing
T1685Disable or Modify Tools

Associated groups

G0092TA505

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Clop.12	AV
Gen:Variant.Ransom.Clop.15	AV
Gen:Variant.Ransom.Clop.17	AV
Gen:Variant.Ransom.Clop.3	AV
Gen:Variant.Ransom.Clop.4	AV
Gen:Variant.Ransom.Clop.9	AV
Generic.Ransom.Clop.0F1C4EC3	AV
Generic.Ransom.Clop.17FF1404	AV
Generic.Ransom.Clop.34F27C13	AV
Generic.Ransom.Clop.435DD3AA	AV
Generic.Ransom.Clop.4F92444D	AV
Generic.Ransom.Clop.7451256F	AV
Generic.Ransom.Clop.A771CD1F	AV
Script-BAT.Ransomware.Clop	ATP Sandbox Adv. Heuristics
Script-Python.Ransomware.Clop	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Clop	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Clop	ATP Sandbox Adv. Heuristics