CL0P

Summary

Identity

CL0P is one of the most disciplined ransomware operations in the cybercriminal landscape, run as a private, core operated entity rather than a traditional affiliate RaaS. It evolved from CryptoMix in February 2019 and has built its reputation on the systematic exploitation of zero-day vulnerabilities in widely deployed enterprise applications, from Accellion and GoAnywhere to PTC Windchill and FlexPLM. ConfirmedS1,S3 The model prioritizes high-volume data extortion through targeted breaches, leveraging a closed operational structure that avoids public recruitment and selectively brings in contracted specialists for surge capacity. on closed modelHighS27,S28 For all its reach, CL0P remains shrouded in attributional uncertainty, with unresolved questions about its core operators, its precise relationship to tracked clusters like FIN11 and TA505, and the identities behind its most recent high-profile campaigns.

Cl0p is a private, core-operated ransomware and data-extortion group that has run continuously since February 2019, when it emerged from the CryptoMix family. CISA and FBI have tracked it since that first international sighting, with the first Canadian observation following in February 2020. ConfirmedS1,S3 It does not operate as a traditional affiliate RaaS. Group-IB and Barracuda describe a closed team with no public affiliate program, recruitment, or revenue split, one that handles access and zero-day exploitation itself and brings in contracted specialists only for surge capacity. Around 2021 the operation moved away from encryption toward data-theft extortion, and it uses its Tor leak site, CL0P^_-LEAKS, as the pressure mechanism. on closed modelHighS27,S28

The group's signature is the mass exploitation of zero-day vulnerabilities in widely deployed enterprise file-transfer and product-lifecycle software, struck at scale in the short window before defenders can patch. That pattern runs from Accellion through GoAnywhere and the 2023 MOVEit campaign, then into the 2024 Cleo, 2025 Oracle E-Business Suite, and 2026 PTC Windchill/FlexPLM campaigns. As of 2026-08-28 the operation is active. Between 2026-08-12 and 2026-08-21 the leak site escalated the Windchill/FlexPLM campaign from redacted listings to full victim naming and posted 40 to 50 organizations, and CISA KEV confirms active exploitation of the underlying vulnerability. on exploitation, A on attributionHighS10,S19,S20,S21,S23,S24,S27

Attribution past the brand is genuinely unsettled, and this card treats it that way rather than papering over it. Government advisories firmly attribute the pre-2023 activity and the GoAnywhere and MOVEit campaigns to Cl0p. The later branded campaigns are tied to it only through self-claimed CL0P branding and Cl0p-consistent tradecraft. The 2026 Windchill campaign is the strongest of those, which ReliaQuest and Ransom-ISAC assess as highly likely Cl0p at the technique level, but even there the operator remains unresolved among the Cl0p core, a contracted partner, and an unrelated actor reusing Cl0p tooling. ModerateS7,S10,S15

The group names themselves do not map cleanly. CISA and FBI equate Cl0p with TA505; Mandiant does not, treating FIN11 as only a subset of TA505 and warning that the names are not interchangeable, and GTIG observed the CL0P brand and leak site used by at least one actor whose tradecraft differed from FIN11. ModerateS1,S6 Microsoft identifies Lace Tempest, formerly DEV-0950, as the operator that runs the extortion site. HighS4 Several names often swept in with Cl0p belong elsewhere on closer reading: Hive0065 is IBM X-Force's label for TA505, TEMP.Warlock's placement is disputed between FIN11 and TA505, MITRE's G0092 identifies the TA505 group while the Cl0p malware is tracked separately as S0611, and Odinaff, a 2016 Symantec name tied to Carbanak, does not belong in the set at all. HighS5,S29,S30 The problem runs deeper than any single card resolves, since the Canadian Cyber Centre's own TA505 alias list even folds in Evil Corp, a separate OFAC-sanctioned actor tracked as Indrik Spider. ModerateS3 For that reason I use "Cl0p" throughout as a handling convention for the brand, the private core-operated operation, and the leak site, and I do not treat it as confirmed identical to FIN11 or TA505. Figure 1 attributes each name to its source without asserting synonymy. ModerateS1,S3,S4,S6,S7

On origin, I assess the broader TA505 cluster as Russian-speaking and very likely based in a CIS country, consistent with the Canadian Cyber Centre. The six suspects arrested in Ukraine in 2021 do not settle the question: HHS called them ransomware operators, INTERPOL described them as facilitators who moved and cashed out funds, and neither stated their nationality. The malware also exits when it detects Russian, Azerbaijani, or Georgian keyboard layouts, which supports a CIS assessment without proving origin. ModerateS3,S8,S2,S18

Figure 1. Attribution map. Each position is attributed to its naming authority; no synonymy is established.

Operating model

Business model: The strongest current reporting supports a private, core-operated ransomware and data-extortion group, not a traditional affiliate RaaS. Group-IB (2026-07-24) calls Cl0p the most disciplined model it tracks and reports no public affiliate recruitment or forum presence. It says the group handles critical access and zero-day exploitation internally or through contracted specialists. Barracuda (2025-05-16) places Cl0p between a pure RaaS and a closed team. Its reporting says the core TA505 team keeps end-to-end control of major zero-day campaigns and selectively allows trusted partners to use the ransomware for a share of proceeds, mainly to add bulk-exfiltration capacity during the shrinking pre-patch window. The Tier 1 "RaaS" label does not prove that a current affiliate program exists. CISA uses it for the 2019 phishing era in the past tense, while the Canadian Cyber Centre uses a generic RaaS definition. TA505 has also acted as an affiliate of other RaaS operations, which causes additional confusion. The operation shifted toward data-theft-only extortion around 2021. on closed modelHighS27,S28 / on RaaS-label reconciliationModerateS1,S3

Partners and surge capacity: Group-IB (2026-07-24) found no documented Cl0p affiliate program, recruitment, revenue split, named affiliates, or forum presence. Some reporting uses "affiliate" for a much narrower relationship. Barracuda (2025-05-16) describes trusted partners or contracted specialists brought into specific operations, mainly to handle bulk data exfiltration when the core team cannot cover every victim before patches close the window. GTIG separately observed at least one user of the CL0P ransomware and leak site in 2025 whose TTPs differed from FIN11. That supports non-exclusive use of the brand and tooling, not a managed affiliate roster. When SecurityWeek, Ransom-ISAC, or another vendor calls a 2026 Windchill actor a "Cl0p affiliate," read it as an actor deploying Cl0p, not as proof of membership in an affiliate program. on no documented programHighS27 / on partner and surge modelModerateS7,S28

Linked groups and lineage: CISA and FBI report that the malware evolved from CryptoMix. Mandiant reports that FIN11 deployed Clop while defining FIN11 as a subset of TA505. HHS reports that Mandiant later merged UNC2546, UNC2582, and UNC4857 into FIN11. Mandiant's earlier interim assessment did not attribute the UNC2546 and UNC2582 Accellion activity to FIN11. ModerateS1,S6,S5,S11

Targeting

Sectors: Cl0p has targeted organizations worldwide across transportation and logistics, education, manufacturing, energy, financial services, aerospace, telecommunications, healthcare, and high technology, according to INTERPOL. HighS8 The 2026 Windchill/FlexPLM leak-site claims span energy, health technology, industrial manufacturing, fintech, and consumer and retail organizations. Those sectors come from the actor's leak site and remain largely unconfirmed. ModerateS10,S19,S20 HHS assessed that roughly 77% of Clop's attempts in 2021 targeted healthcare. That conflicts with the broader multi-sector picture reported by INTERPOL and Ransom-ISAC, and I could not resolve the difference. ModerateS16

Geography: Cl0p operates worldwide. INTERPOL investigated attacks in South Korea and the United States, while FIN11 operations have mainly targeted North America and Europe. HighS8,S5

Exclusions: Clop malware stops when it detects Russian, Azerbaijani, or Georgian keyboard layouts or the Russian Windows charset. That is a malware-level exclusion, not proof that every operator follows the same rule. HighS2 Clop separately told BleepingComputer that it avoids military organizations, children's hospitals, and governments and deletes any data taken from them. Documented U.S. government victims and sustained healthcare targeting contradict that claim, and I could not confirm the claimed deletion. UnverifiedS12

Confirmed victims:

Community Health Systems confirmed a Fortra GoAnywhere breach affecting an estimated one million people in an SEC 8-K. The filing confirms the breach but does not attribute it to Clop. ConfirmedS14

HHS reports that Clop's claim to the Community Health Systems and GoAnywhere breach remains uncorroborated. UnverifiedS16

Ukrainian Cyber Police attributed the 2021 suspects to attacks against four unnamed Korean companies, Stanford University School of Medicine, the University of Maryland, and the University of California. ConfirmedS9

Claimed victims. Keep these separate from confirmed breaches:

Clop claimed approximately 130 GoAnywhere victims over ten days. UnverifiedS1

The leak site listed 59 organizations after the Cleo exploitation. Hertz, Linfox, Arrow Electronics, and Western Alliance Bank disputed the claims or found no evidence supporting them. UnverifiedS13

Covestro told the media that Clop contacted the company and accessed data on a U.S. logistics server during the Cleo campaign. This comes from one Tier 3 source reporting a victim statement and is not independently confirmed. UnverifiedS13

On 2026-07-22, the Windchill/FlexPLM campaign had produced extortion emails but no leak-site listings. That was accurate on that date and was superseded by the August 2026 listings below. HighS10

Windchill/FlexPLM campaign, 2026-08-12 to 2026-08-21: The leak site named 40 to 50 organizations, including Shell, Philips, GE, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, Largan Precision, Mammut, and Suunto. Clop claimed it stole roughly 89 GB from Shell and 13.5 GB from Philips. Every listing is a self-claim. Shell and GE have said only that they are investigating and have not confirmed a breach. Philips confirmed that it identified and contained an attempted compromise of a specific internal enterprise server with no impact on customer environments. That confirms a contained internal-server incident, not Clop's specific data-theft claim. Toast, Zebra Technologies, and the other named organizations have not publicly confirmed a breach. UnverifiedS19,S20,S21,S23

Tradecraft

Initial access: The observed techniques are high-volume spearphishing (T1566) and exploitation of public-facing applications (T1190). ConfirmedS1 For the 2025 and 2026 exploit chains, keep the campaign-attribution boundary above in view. The 2025 Oracle EBS campaign used SyncServlet and related exploit chains. HighS7 The 2026 campaign chained FlexPLM WSDL disclosure with a Windchill login-servlet flaw to achieve unauthenticated RCE. HighS10

Notable TTPs: CISA maps the operation to T1190, T1566, T1059.001, T1059.003, T1129, T1505.003, T1546.011, T1068, T1055, T1070, T1574.002, T1018, T1021.002, T1563.002, T1113, T1071, T1105, and T1041. ConfirmedS1 In 2026, investigators also observed JSP webshell deployment, filesystem enumeration, engineering-data staging, and data theft for double extortion. The behaviors are confirmed. Attribution to Cl0p remains suspected. on behaviorHighS10 / on attributionModerateS10

Exploited CVEs:

Microsoft's consolidated list includes CVE-2021-27101/27102/27103/27104 (Accellion), CVE-2023-0669 (GoAnywhere), CVE-2023-34362 (MOVEit), CVE-2024-50623 and CVE-2024-55956 (Cleo), and CVE-2025-61882 (Oracle). HighS2

2025: Attackers exploited CVE-2025-61882 and/or CVE-2025-61884 as zero-days in the Oracle EBS campaign. HighS15 The exploitation is observed, but the actor's use of CL0P branding remains a self-claim. UnverifiedS15

2026: Attackers exploited CVE-2026-12569 in PTC Windchill/FlexPLM as a zero-day beginning in early June 2026, before PTC disclosed and patched it on 2026-06-17. CISA added it to KEV, confirming active exploitation. HighS21,S22 ReliaQuest and Ransom-ISAC assess the exploitation as highly likely Clop, using ReliaQuest's own term. That moves the campaign from unattributed to high-confidence Clop attribution at the technique level, but it does not identify the operator. The remaining possibilities are the Cl0p core, a contracted partner working for it, or an unrelated actor reusing Cl0p tradecraft and branding. Cl0p has no documented affiliate program, so this is not a core-versus-affiliate question. ReliaQuest still treats the actor as unconfirmed because the assessment rests on tradecraft overlap. on Clop attributionHighS21,S23,S24 / on operator identityModerateS24,S27,S28 Ransomware.live lists CVE-2026-4681 for this campaign. CVE-2026-4681 is a real but separate PTC Windchill/FlexPLM critical RCE with a CVSS score of 10.0 caused by deserialization. PTC disclosed it in March 2026, CISA covered it in advisory ICSA-26-085-03, and PTC said it had no evidence of confirmed customer exploitation. No public evidence ties CVE-2026-4681 to the June to August 2026 Clop campaign. Every primary and vendor source for that campaign identifies CVE-2026-12569. Treat CVE-2026-4681 as a genuine but separate vulnerability, not the campaign CVE and not a tracker artifact. ModerateS10,S22,S25 On 2026-08-20, after the campaign activity described above, PTC disclosed CVE-2026-77645, a critical RCE, and CVE-2026-77646, a high-severity SSRF. I found no public evidence attributing either vulnerability to Clop. They are current platform risks, not Clop-exploited CVEs. on disclosureHighS26 / on non-attributionModerateS26

Tooling and malware: CISA associates Clop with FlawedAmmyy/FlawedGrace, SDBot, Truebot, Cobalt Strike, DEWMODE, LEMURLOOT, and TinyMet. Some of those tools belong to TA505 or campaign partners and are not exclusive to Clop. HighS1 A Linux Clop variant first appeared on 2022-12-26. HighS16 The 2025 Oracle campaign used GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. GTIG did not formally attribute that campaign to a tracked group, so treat them as campaign tooling, not confirmed CL0P-core tooling. on toolingHighS7

Extortion method: Cl0p historically used double extortion through encryption, data theft, and threats to publish on Tor. Since 2021, it has increasingly relied on data exfiltration without encryption. ConfirmedS1 In 2025, executive-targeted extortion emails included legitimate file listings as proof. HighS7 In 2026, the campaign sent emails from apparently compromised accounts to hundreds of users and then supplied Clop contact instructions. The behavior is observed; Clop attribution remains suspected. on behaviorHighS10 / on attributionModerateS10

Figure 2. Signature TTP. Zero-day exploitation of internet-exposed enterprise file-transfer and product-lifecycle software; status chips carry the confidence in attribution.

Infrastructure and finance

Infrastructure: Cl0p operates a Tor data-leak site branded "CL0P^_-LEAKS," a separate onion negotiation portal, and email-based negotiation contacts. This card intentionally withholds specific C2 addresses, webshell paths, file hashes, and onion URLs. Those indicators remain available in the cited advisories. HighS2

Payments and laundering: The 2021 suspects handled Clop ransom payments in cryptocurrency, and law enforcement blocked the channels used to launder the proceeds. INTERPOL described the suspects as transfer and cash-out facilitators. HHS called them operators. Their role remains disputed, as noted in Identity. ConfirmedS9,S8

Estimated financial impact: Chainalysis estimated that the 2023 MOVEit campaign collected more than $100 million in ransom payments. It accounted for roughly 44.8% of ransomware value received in June and 39.0% in July 2023. Chainalysis says its totals are conservative. Ukrainian Cyber Police estimated approximately $500 million by 2021-06-16. The primary Ukrainian source describes that figure as total losses, while HHS describes it as ransom payouts. I could not resolve the difference, so treat it as a losses estimate, not verified payments. ModerateS17,S9,S18

Ransom demand range: HHS reported demands from a few hundred thousand USD to $10 million in 2023. ModerateS5

Timeline

Figure 3. Operational timeline. Green nodes are government or vendor-confirmed; red nodes are self-claimed and unverified.

• February 2019: CL0P appears. CISA and FBI describe it as evolving from CryptoMix. ConfirmedS1
• 2020: The "CL0P^_-LEAKS" data-leak site is established. HighS7
• June 2021: Ukrainian authorities conduct 21 searches, arrest six suspects, and disrupt infrastructure and laundering channels in Operation Cyclone. ConfirmedS9,S8
• January to May 2023: Attackers exploit GoAnywhere (CVE-2023-0669) and then MOVEit (CVE-2023-34362) for mass data theft and extortion. MOVEit exploitation begins on 2023-05-27. ConfirmedS1
• December 2024 to January 2025: The leak site lists 59 claimed victims after the Cleo exploitation. Several organizations dispute that they were compromised. UnverifiedS13
• August to September 2025: An actor using CL0P branding exploits Oracle EBS and begins sending high-volume executive extortion emails on 2025-09-29. GTIG does not formally attribute the campaign to a tracked group. ModerateS7
• June to July 2026: Attackers exploit CVE-2026-12569 as a zero-day beginning in early June. CISA KEV confirms active exploitation. Extortion emails begin on 2026-07-20. ReliaQuest and Ransom-ISAC assess the activity as highly likely Clop. The operator remains unresolved among the Cl0p core, a contracted partner, and an unrelated actor reusing Cl0p tradecraft and branding. Cl0p has no documented affiliate program. on exploitationHighS21,S22 / on Clop attributionHighS23,S24 / on operator identityModerateS24,S27,S28
• August 2026: The leak site switches the Windchill/FlexPLM campaign from redacted listings to full victim naming on 2026-08-12. The list grows to 40 to 50 organizations and peaks around 2026-08-15/16. By roughly 2026-08-21, the count stabilizes and GE is reportedly removed from the site. I found no evidence establishing whether removal meant payment or renewed negotiation. Every victim listing remains a self-claim. Philips confirmed a contained internal-server incident, not Clop's specific data-theft claim. Shell and GE confirmed only that they were investigating. The other named organizations did not publicly confirm a breach. UnverifiedS19,S20,S21,S23

Law enforcement and legal

Law-enforcement actions: In June 2021, Ukrainian authorities searched 21 locations and arrested six suspects, seizing equipment, vehicles, and cash. INTERPOL's Operation Cyclone resulted in six arrests, two Red Notices, and approximately $185,000 seized. The action disrupted infrastructure and laundering channels, but activity under the CL0P brand continued in later years (see Timeline). ConfirmedS9,S8

Legal status: Ukrainian authorities opened criminal proceedings against the 2021 suspects in June 2021 under Articles 361(2) and 209(2), which carry up to eight years. INTERPOL circulated two Red Notices in November 2021. I could not verify the current 2026 status of the proceedings or notices. ConfirmedS9,S8

Analyst assessment

I assess CL0P as a durable, financially motivated, privately run data-extortion operation, not a traditional affiliate RaaS. Since 2021, its defining tradecraft has been the likely mass exploitation of zero-days in enterprise managed-file-transfer and business-application software: Accellion, GoAnywhere, MOVEit, Cleo, Oracle EBS, and PTC Windchill/FlexPLM. The group uses that access for high-volume extortion and does not always encrypt systems. Group-IB's current reporting from 2026-07-24 describes a closed, core-operated model with no affiliate recruitment, revenue split, or forum presence. It reports contracted specialists for surge exfiltration rather than a recruited affiliate roster. Barracuda places Cl0p between a pure RaaS and a closed team. Attribution remains the weak point. Authoritative sources do not agree that Cl0p, FIN11, and TA505 are the same entity, and the evidence does not establish synonymy. The 2024 Cleo and 2025 Oracle EBS campaigns rely on self-claimed CL0P branding and Cl0p-consistent tradecraft that vendors did not formally attribute. ReliaQuest and Ransom-ISAC now assess the 2026 Windchill/FlexPLM activity as highly likely Clop. Because Cl0p has no documented affiliate program, the remaining question is operator identity: the Cl0p core, a contracted partner, or an unrelated actor reusing Cl0p tradecraft and branding. Moderatederived

Outlook

I assess that Cl0p will continue periodic mass exploitation of newly discovered zero-days in widely deployed enterprise file-transfer and PLM software. That is the most likely near-term pattern. The brand will probably persist even when the operators behind individual campaigns differ. Low to Moderatederived

Intelligence gaps

The identities and location of the core operators remain unresolved. The Russian-speaking and CIS assessment does not resolve the role of the Ukraine-based facilitators who were arrested.

The operator behind the 2024 to 2026 branded campaigns remains unresolved. It could be the Cl0p core, a contracted partner working for it, or an unrelated actor reusing Cl0p tradecraft and branding. Cl0p has no documented affiliate program, so this is not a core-versus-affiliate question. The relationship between these actors and the historical FIN11 core is also unresolved.

Confirmed and claimed victim counts differ sharply across campaigns.

I could not verify the current 2026 status of the 2021 Ukrainian proceedings or the INTERPOL Red Notices.

GE was reportedly removed from the leak site, but the reason remains unconfirmed. Payment and renewed negotiation are both possible, and the claim comes from only one secondary report.

None of the 40 to 50 organizations named in the August 2026 Windchill/FlexPLM listings has publicly confirmed Clop's specific data-theft claim. Philips confirmed a contained internal-server incident. Shell and GE confirmed only that they were investigating. The other named organizations made no public statement. The actual victim set and impact remain unverified.

PTC's Windchill/FlexPLM platform has three separate 2026 vulnerability disclosures relevant here: CVE-2026-4681 in March, CVE-2026-12569 in June, and CVE-2026-77645 plus CVE-2026-77646 on 2026-08-20. Only CVE-2026-12569 is tied to Clop. I do not know whether this campaign or copycats will adopt the others. ReliaQuest assesses with moderate confidence that copycats will use CVE-2026-12569 as exploit code spreads.