Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 25826 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 25826 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-09-10 Latest victim discovery date
Inactive since 4 days Days since the latest known victim
Top country United States 11694 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Leak Status Distribution

No leak-status data available yet.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 2 Onion service Up checked 1h ago santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Down checked 1h ago toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
    Leak location 1 Onion service Down checked 1h ago ekbgzchl6x2ias37.onion

    Top Activity Sectors (5)

    1. Technology 146
    2. Transportation/Logistics 68
    3. Consumer Services 65
    4. Manufacturing 64
    5. Business Services 34

    YARA Rules (1)

    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (25826)

    Search, filter and paginate the victim timeline for Cl0p. Showing 14801–14900 of 25826.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32632 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32632 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32633 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32637 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32637 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32637 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32639 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32640 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32640 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32641 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32642 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32643 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32644 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32644 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32646 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32647 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32648 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32651 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32652 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32652 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32653 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32655 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32655 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32655 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32655 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32656 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32656 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32656 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32656 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32660 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32663 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32665 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32669 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32671 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32676 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32677 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32678 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32679 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32700 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32701 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32701 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32701 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32701 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32701 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32702 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32702 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32703 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32704 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32704 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32704 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32704 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32705 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32705 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32710 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32711 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32715 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32718 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32719 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32721 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32729 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32731 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32732 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32736 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32738 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32741 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32744 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32745 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32745 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32748 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32748 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32748 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32749 View details Mexico Retail / E-commerce
    Ransomware BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) id32752 View details Mexico Retail / E-commerce