Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Clop/Cl0p

Active
World map Statistics ATT&CK Navigator
The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.

At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware.

After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp, .Cllp, and .C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption. Depending on the variant, any of the ransom text files were created with names like 'ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.'

The Clop operation has shifted from delivering its final payload via phishing and has begun initiating attacks using vulnerabilities that resulted in the exploitation and infection of victims' infrastructures.
Source: https://github.com/crocodyli/ThreatActors-TTPs
Victims
1,303
none this month
Rank
#5 / 388
#9 over the last 12 months
First victim
2020-03-13
estimated attack date
Last victim
2026-10-21
25 days ago
Attack → claim
7.0 d
average delay
Countries
58
hit
Infostealer
55.0%
of victims with a domain
Data leaked
48.8 TB
reported for 43 victims
Leak-site uptime
88.4% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Technology 242 · 19%
  • Professional Services 218 · 17%
  • Retail & E-Commerce 184 · 14%
  • Manufacturing 160 · 12%
  • Transportation 97 · 7%
  • Financial Services 87 · 7%
  • Healthcare 76 · 6%
  • Education 46 · 4%
  • Energy & Utilities 44 · 3%
  • Agriculture and Food Production 43 · 3%

Top countries

What ransomware.live knows about clop