Threat Actor Characterization
Cl0p
ID: e5ae61159b88ad01b6af770ffc94d07d60709| Cl0p Ransomware | Cl0p Ransomware Group | C***** | c*** |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Cl0p is a cybercrime extortion brand commonly linked in public reporting to the TA505/FIN11 ecosystem, notable for mass exploitation of enterprise MFT platforms to enable data theft and leak-site coercion.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1505.003 | Web Shell | TA0003 |
|
| T1059.001 | PowerShell | TA0002 |
|
| T1059.003 | Windows Command Shell | TA0002 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1070 | Indicator Removal | TA0005 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
Cl0p — RaaS brand / mass data-extortion via managed file transfer (MFT) exploitation
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Cybercrime / Ransomware & Extortion — Origin: INFERENCE (confidence: high): Russian-speaking ecosystem
Author: iQBlack CTI Team
Executive Summary
Cl0p (also stylized as CL0P / Clop) is a long-running ransomware-and-extortion brand commonly linked in public reporting to the TA505/FIN11 criminal ecosystem. The brand is notable for combining classic “big game hunting” intrusion playbooks with periodic, high-scale supply-chain style data-theft waves driven by exploitation of managed file transfer (MFT) products. The most widely documented mass exploitation wave was the 2023 MOVEit Transfer campaign, where the actor leveraged a SQL injection vulnerability (CVE-2023-34362) and deployed a web shell commonly referenced as LEMURLOOT to exfiltrate data.
A recurring strategic characteristic is the actor’s preference for extortion leverage based on data theft and public exposure, including operating or advertising a Tor-hosted leak site (“name-and-shame”), and in at least one phase, publishing stolen data via torrent-based distribution mechanisms. In several campaigns, public reporting indicates encryption may be absent or secondary to data-theft-driven coercion.
From a defender perspective, Cl0p is best modeled as an ecosystem actor with two operating modes: (1) affiliate-style intrusions that look like mainstream ransomware operations (initial access brokers, phishing, loaders, lateral movement); and (2) opportunistic mass exploitation where the compromised component is the MFT application itself, and the actor may not require full domain-wide lateral movement to achieve monetization.
