Clop (ELF)
Aliases: Cl0p
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-20 17:57:10
- Profile updated
- 2026-07-07 14:22:20
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications education-and-nonprofits
Context
Clop (ELF) is a variant of the Clop ransomware designed to target Linux systems. It encrypts files on the victim's machine and demands a ransom for decryption.
Used by threat actors
- Cleo File Transfer Software Zero-Day Exploits (CVE-2024-50623 & CVE-2024-55956) (campaign)
- Clop MOVEit Transfer Vulnerability Exploitation (campaign)
Reports & references
- Cisco Talos — Talos Ir Q2 2023 Quarterly Recap (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Clop (report)
- sentinelone.com — Cl0P Ransomware Targets Linux Systems With Flawed Encryption Decryptor Available (report)
- bleepingcomputer.com — March 2023 Broke Ransomware Attack Records With 459 Incidents (report)
- cert.ssi.gouv.fr — Certfr 2019 Cti 009 (report)
- helpnetsecurity.com — Cl0P Ransomware Decryptor Linux (report)