Clop
MITRE ATT&CK: S0611 View on attack.mitre.org
Aliases: Cl0p, Clop
- First seen
- 2019-02-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 161 (68 malicious)
- Last IoC activity
- 2026-10-17 18:15:14
- Profile updated
- 2026-07-07 12:40:28
Targeted industries: education-and-nonprofits energy-and-utilities financial-services healthcare-and-pharmaceutical manufacturing professional-services retail-and-hospitality technology-and-telecommunications transportation-and-logistics
Context
Clop is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace, telecommunications, professional and legal services, healthcare, and high tech industries. Clop is a variant of the CryptoMix ransomware.
Recent IoC activity
68 malicious indicators in Maltiverse are attributed to Clop (S0611). The 20 most recently updated:
Detection coverage
- 2 YARA rules
- 389 Sigma rules
Malware & tools used
- Security Software Discovery (attack-pattern)
- Service Stop (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Native API (attack-pattern)
- Time Based Checks (attack-pattern)
- Software Packing (attack-pattern)
- System Language Discovery (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Process Discovery (attack-pattern)
- Windows Command Shell (attack-pattern)
- Code Signing (attack-pattern)
- Modify Registry (attack-pattern)
- Network Share Discovery (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Msiexec (attack-pattern)
Used by threat actors
- TA505 (threat-actor)
- Cleo File Transfer Software Zero-Day Exploits (CVE-2024-50623 & CVE-2024-55956) (campaign)
- Clop MOVEit Transfer Vulnerability Exploitation (campaign)
Detection rules
- MALPEDIA_Win_Clop_Auto (yara-rule)
- DITEKSHEN_MALWARE_Win_Clop (yara-rule)
Reports & references
- CrowdStrike — Report2021Gtr (report)
- medium.com — Operation Synctrek E5013Df8D167 (report)
- Mandiant — Financially Motivated Actors Are Expanding Access Into Ot (report)
- zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
- Microsoft — Raspberry Robin Worm Part Of Larger Ecosystem Facilitating Pre Ransomware Activity (report)
- blog.malwarebytes.com — Clop Targets Execs Ransomware Tactics Get Another New Twist (report)
- Palo Alto Unit 42 — Clop Ransomware (report)
- actu.fr — Une Rancon Apres Cyberattaque Chu Rouen Ce Reclament Pirates 29475649 (report)
- asec.ahnlab.com — 19542 (report)
- asec.ahnlab.com — Analysis Reportclop Ransomware (report)
- github.com — Tafof Unpacker (report)
- github.com — Clop.Md (report)
- github.com — Clop.Md (report)
- krebsonsecurity.com — Ukrainian Police Nab Six Tied To Clop Ransomware (report)
- labs.sentinelone.com — Breaking Ta505S Crypter With An Smt Solver (report)
- media.kasperskycontenthub.com — Common Ttps Of The Modern Ransomware Low Res (report)
- medium.com — Unpacking Clop 416B83718E0F (report)
- Kaspersky — 106824 (report)
- McAfee — Clop Ransomware (report)
- therecord.media — Ukrainian Police Arrest Clop Ransomware Members Seize Server Infrastructure (report)
- twitter.com — 1338692764121251840 (report)
- binance.com — Binance Helps Take Down Cybercriminal Ring Laundering %24500M In Ransomware Attacks (report)
- bleepingcomputer.com — Clop Ransomware Gang Is Back Hits 21 Victims In A Single Month (report)
- bleepingcomputer.com — Cryptomix Clop Ransomware Says Its Targeting Networks Not Computers (report)
- bleepingcomputer.com — Indiabulls Group Hit By Clop Ransomware Gets 24H Leak Deadline (report)