What is Clop Ransomware?

Clop Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Enterprises via exploited web app gateways; mass exploitation campaigns

Source Attribution

Origin: MITRE
Source: CISA KEV · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA KEV · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2019-02 discovered Clop first observed
2023-06 exploited MOVEit Transfer mass exploitation
2023-06 updated CISA advisory AA23-263A

Quick Answer

Clop operators exploit file-transfer appliances, exfiltrate data and encrypt networks, publishing victims on a leak site.

Definition

Clop is an RaaS that has run large-scale exploitation campaigns (Accellion FTA, MOVEit Transfer), using zero-days to mass-encrypt and exfiltrate.

Overview

Clop is an RaaS that has run large-scale exploitation campaigns (Accellion FTA, MOVEit Transfer), using zero-days to mass-encrypt and exfiltrate.

Behavior

File-transfer appliance zero-days
Bulk exfiltration to leak site
Fraudulent ransom emails to victims

First Seen

2019-02

Target

Enterprises via exploited web app gateways; mass exploitation campaigns

Techniques: T1190, T1567, T1486
Campaigns: moveit-cl0p-exploitation
Related CVEs: CVE-2023-34362, CVE-2021-30116

Malware Intelligence

Family: Clop Ransomware

Aliases: Clop, Cl0p

Techniques: T1190, T1567, T1486

Targets: Enterprises via exploited web app gateways; mass exploitation campaigns

Behavior:

File-transfer appliance zero-days
Bulk exfiltration to leak site
Fraudulent ransom emails to victims

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Clop Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Clop Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.