Ransomware Intelligence / Groups / clop
Ransomware group
clop
Clop is a ransomware which uses the .clop extension after having encrypted the victim's files. Another unique characteristic belonging with Clop is in the string: "Dont Worry C|0P" included into the ransom notes. It is a variant of CryptoMix ransomware, but it additionally attempts to disable Windows Defender and to remove the Microsoft Security Essentials in order to avoid user space detection.
- 0claims, 7 days
- 1claims, 30 days
- 69claims, 90 days
- 2026-04-06first seen
- 2026-10-21last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name clop, newest first.
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
- ShinyHunters Claim Hack of Rival Ransomware Gang Clop
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
- Manufacturing 22
- Unclassified 17
- Technology 8
- Financial services 5
- Retail 5
- Professional services 4
- Critical infrastructure 3
- Higher education 3
- Government 1
- Healthcare 1
Countries claimed, last 90 days
- United States 28
- Unknown 6
- United Kingdom 6
- India 4
- Canada 3
- Italy 3
- Australia 2
- Finland 2
- Switzerland 1
- China 1
- Colombia 1
- Spain 1
- HU 1
- IR 1
- KZ 1
Vulnerabilities clop exploits
CVEs attributed to clop by Ransomware.live, most severe first. Patch these first if this group is in your threat model.
| CVE | Vendor / product | CVSS | CISA KEV |
|---|---|---|---|
| CVE-2026-12569 | PTC Windchill PDMLink / FlexPLM | 9.8 Critical | Listed 2026-06-25, ransomware use |
| CVE-2025-61882 | Oracle Corporation Oracle Concurrent Processing | 9.8 Critical | Listed 2025-10-06, ransomware use |
| CVE-2024-55956 | Cleo Cleo VLTrader, Harmony, LexiCom | 9.8 Critical | Listed 2024-12-17, ransomware use |
| CVE-2024-50623 | Cleo Cleo MFT Solutions (Harmony, VLTrader, LexiCom) | 9.8 Critical | Listed 2024-12-13, ransomware use |
| CVE-2023-34362 | Progress Software MOVEit | 9.8 Critical | Listed 2023-06-02, ransomware use |
| CVE-2023-27351 | PaperCut PaperCut Application Server | 9.8 Critical | Listed 2026-04-20, ransomware use |
| CVE-2023-27350 | PaperCut PaperCut Application Server | 9.8 Critical | Listed 2023-04-21, ransomware use |
| CVE-2021-27104 | Accellion Accellion File Transfer Appliance | 9.8 Critical | Listed 2021-11-03, ransomware use |
| CVE-2021-27103 | Accellion Accellion File Transfer Appliance | 9.8 Critical | Listed 2021-11-03, ransomware use |
| CVE-2021-27102 | Accellion Accellion File Transfer Appliance | 9.8 Critical | Listed 2021-11-03, ransomware use |
| CVE-2021-27101 | Accellion Accellion File Transfer Appliance | 9.8 Critical | Listed 2021-11-03, ransomware use |
| CVE-2026-4681 | PTC Windchill PDMLink | 9.3 Critical | Not listed |
| CVE-2021-35211 | SolarWinds SolarWinds Serv-U FTP | 9.0 Critical | Listed 2021-11-03, ransomware use |
| CVE-2025-11371 | CentreStack Gladinet CentreStack | 7.5 High | Listed 2025-11-04 |
| CVE-2023-0669 | Fortra GoAnywhere Managed File Transfer | 7.2 High | Listed 2023-02-10, ransomware use |
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for clop by Ransomware.live, in attack order.
Remote encryption risk. The techniques reported for clop include encrypting data (T1486) and spreading over SMB / Windows admin shares (T1021.002): the building blocks of remote encryption, where files on protected servers are encrypted over the network from a device the attacker controls.
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Track clop in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 13 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology