Quick links
Press Enter to search, Esc to close
Threat group profile
CISA and the FBI say, "according to open source information", that the CL0P ransomware gang is also known as TA505, and MITRE ATT&CK describes TA505 as a cyber criminal group active since at least 2014.
In short
CISA and the FBI say, "according to open source information", that the CL0P ransomware gang is also known as TA505, and MITRE ATT&CK describes TA505 as a cyber criminal group active since at least 2014. As attributed by those bodies, it steals data and runs ransomware, including through zero-day flaws in file transfer software such as MOVEit Transfer.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| TA505 | MITRE ATT&CK group name; also used by CISA and the FBI in AA23-158A and by the Canadian Cyber Centre[1, 2, 4] |
| CL0P | CISA and the FBI write "CL0P Ransomware Gang, also known as TA505". Also the name of the ransomware. The Cyber Centre says it is sometimes written CLOP, Clop or Cl0p[2, 4] |
| Hive0065 | MITRE ATT&CK Associated Groups; also listed by the Canadian Cyber Centre[1, 4] |
| Spandex Tempest | MITRE ATT&CK Associated Groups; also listed by the Canadian Cyber Centre[1, 4] |
| CHIMBORAZO | MITRE ATT&CK Associated Groups; the Canadian Cyber Centre writes Chimborazo[1, 4] |
| GRACEFUL SPIDER | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
| Lace Tempest | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
| DEV-0950 | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
| FIN11 | Listed as an alias only by the Canadian Cyber Centre. A CISA analyst note ties the Clop ransomware to FIN11. Not in MITRE's list[4, 7] |
| GOLD TAHOE | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
| GOLD EVERGREEN | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
| ATK103 | Listed as an alias only by the Canadian Cyber Centre, not in MITRE's list[4] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 3.0, last modified 31 July 2026
Describes TA505 as a cyber criminal group active since at least 2014, known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1]
CISA and FBI 7 June 2023
In advisory AA23-158A, say that "according to open source information" the CL0P Ransomware Gang, also known as TA505, began exploiting the MOVEit Transfer flaw CVE-2023-34362 on 27 May 2023.[2]
CISA and FBI 7 June 2023
Their news release repeats that the CL0P Ransomware Gang is also known as TA505, again "according to open-source information".[3]
CISA and FBI 7 June 2023
In the same advisory, say TA505 has operated a ransomware-as-a-service business, acted as an affiliate of others, worked as an initial access broker, bought access from others and run a large botnet for financial fraud and phishing.[2]
Canadian Cyber Centre 11 July 2023
Says CL0P is operated by the cybercriminal group TA505, and assesses TA505 as almost certainly a financially motivated, Russian-speaking ransomware-as-a-service group, very likely based in a Commonwealth of Independent States country.[4]
Canadian Cyber Centre 16 June 2023 (as reported 11 July 2023)
Reports that on 16 June 2023 the US State Department announced a reward of up to 10 million US dollars for information "linking CL0P Ransomware Gang or any other malicious cyber actors targeting U.S. critical infrastructure to a foreign government". This ties to CL0P only, not TA505. It asks for information and states no link.[4]
INTERPOL 5 November 2021
Says six members of a ransomware family were arrested in Ukraine in June 2021, with Korean, Ukrainian and US police, after attacks by the "Cl0p ransomware threat group". The page does not use the name TA505.[5]
National Police of Ukraine, Cyberpolice 16 June 2021
Announced a group that used the Clop ransomware against companies in Korea and the US. The page does not use the name TA505.[6]
CISA Undated page
An analyst note says Clop is "a ransomware variant associated with the FIN11 threat actor group". The page does not use the name TA505.[7]
Sources differ on how CL0P and TA505 relate. CISA and the FBI treat the CL0P gang and TA505 as one, but word it as "according to open source information". MITRE lists Clop as one of several ransomware families TA505 has used, and the Canadian Cyber Centre says TA505 operates CL0P. A CISA analyst note ties Clop to FIN11 and not to TA505, and the 2021 INTERPOL and Ukrainian police pages and the State Department reward post (as reported by the Cyber Centre) name only Clop, never TA505. Alias lists differ: MITRE gives three names, while the Cyber Centre gives eleven, including FIN11. On the 2021 operation, INTERPOL says the suspects moved more than USD 500 million in funds, while Ukrainian police give 500 million dollars as the total damage.
Each entry is attributed to the group by the sources cited.
CISA and the FBI say TA505 actors used CL0P as the final payload of a phishing campaign with a macro-enabled document and the Get2 dropper.[2]
Ukrainian police say the Clop ransomware blocked 810 internal servers and staff computers at four Korean companies.[6]
CISA and the FBI say TA505 used several zero-day exploits to install the DEWMODE web shell on Accellion FTA servers.[2]
CISA and the FBI say that in recent campaigns beginning 2021, CL0P preferred to rely mostly on data exfiltration over encryption.[2]
CISA and the FBI say the CL0P group used a zero-day flaw, CVE-2023-0669, against GoAnywhere MFT.[2]
CISA and the FBI say the gang began exploiting CVE-2023-34362 and installed the LEMURLOOT web shell to steal data.[2]
CISA added CVE-2023-34362 to its Known Exploited Vulnerabilities Catalog.[2]
The Canadian Cyber Centre reports a US State Department reward offer naming the CL0P gang.[4]
The Canadian Cyber Centre published its TA505 and CL0P profile.[4]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| June 2021 | Ukrainian police with INTERPOL, Korean and US police | Operation Cyclone arrests and searchesINTERPOL says six suspects were arrested in Ukraine, more than 20 locations searched and USD 185,000 seized. Ukrainian police report 21 searches. These pages name Clop, not TA505.[5, 6] |
| 16 June 2021 | National Police of Ukraine, Cyberpolice | Public announcementReports a group that used the Clop ransomware against companies in Korea and the US, with a criminal case opened and up to eight years in prison possible.[6] |
| 5 November 2021 | INTERPOL | Red Notices and public reportTwo Red Notices were circulated to member countries after a request from Korea's cybercrime investigation division.[5] |
| 2 June 2023 | CISA | Known exploited vulnerability listingAdded CVE-2023-34362 (MOVEit Transfer) to its Known Exploited Vulnerabilities Catalog.[2] |
| 7 June 2023 | CISA and FBI | Joint advisory AA23-158AShares indicators and tactics of the CL0P gang, also known as TA505, and asks victims to report to the FBI. Updated 16 June 2023.[2, 3] |
| 16 June 2023 | US Department of State (as reported by the Canadian Cyber Centre) | Reward offerUp to 10 million US dollars for information linking the CL0P gang or other malicious cyber actors to a foreign government. It names CL0P, not TA505. The offer asks for information and states no link.[4] |
| 11 July 2023 | Canadian Cyber Centre | Threat profileAssesses TA505 as a financially motivated cybercrime group that operates CL0P.[4] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Exploit Public-Facing Application T1190
CISA and the FBI say CL0P exploited the MOVEit Transfer zero-day CVE-2023-34362, starting with a SQL injection.[2, 14]
Phishing: Spearphishing Attachment T1566.001
MITRE says TA505 used spearphishing emails with malicious attachments.[1, 15]
Phishing: Spearphishing Link T1566.002
MITRE says TA505 sent spearphishing emails with malicious links.[1, 17]
User Execution: Malicious File T1204.002
MITRE says TA505 used lures to get users to enable content in attachments and run files from archives.[1, 19]
Command and Scripting Interpreter: PowerShell T1059.001
MITRE says TA505 used PowerShell to download and run malware and reconnaissance scripts.[1, 21]
Clop Ransomware
MITRE says it was first seen in February 2019 and is a variant of CryptoMix. CISA and the FBI say it was offered as ransomware as a service.[2, 8]
Get2 Downloader
MITRE says TA505 used it to deliver FlawedGrace, FlawedAmmyy, Snatch and SDBbot.[9]
SDBbot Backdoor
MITRE says TA505 has used it since at least 2019.[10]
FlawedAmmyy Remote access tool
MITRE says it was first seen in early 2016 and is based on leaked Ammyy Admin source code.[11]
FlawedGrace Remote access tool
MITRE describes it as a fully featured remote access tool written in C++, first seen in late 2017.[12]
Dridex Banking trojan
MITRE lists it for TA505. The Canadian Cyber Centre links TA505 botnet work to it.[4, 13]
Cobalt Strike Commercial attack tool
CISA and the FBI say it is used to widen network access after reaching the Active Directory server.[2, 22]
LEMURLOOT Web shell
CISA and the FBI say it is a C# web shell aimed at MOVEit Transfer, used to steal data.[2]
DEWMODE Web shell
CISA and the FBI say it is a PHP web shell aimed at Accellion FTA devices, used to steal data.[2]
Truebot Downloader
CISA and the FBI say that in the TA505 case it was used to download FlawedGrace or Cobalt Strike beacons.[2]
CISA and the FBI say to keep software and firmware up to date and to prioritize patching known exploited flaws in internet-facing systems.
Counters T1190
Limit PowerShell through Group Policy to people who need it, and move to the latest version.
Counters T1059.001
Use application controls and allowlisting so only approved software runs.
Counters T1204.002
Separate parts of the network to limit how far ransomware can spread.
Counters T1078.002
Make sure backups are encrypted, cannot be altered or deleted, and cover the whole organization.
Counters T1486
Follow ransomware groups and leak-site activity to see whether your company or suppliers are named.
Find internet-facing file transfer and web systems so they can be patched or closed.
Watch for stolen company data and credentials offered on criminal sites.
Use reports on ransomware actors and their methods to guide defense choices.
Spot look-alike domains and phishing used to spread malware.
CISA and the FBI write that the CL0P Ransomware Gang is "also known as TA505", based on "open source information". MITRE lists Clop as one ransomware family TA505 has used. Some government pages name only Clop.
No source opened states a state link. The Canadian Cyber Centre assesses TA505 as a financially motivated cybercrime group. A US State Department reward post, as reported by the Cyber Centre, asked for information on a possible foreign government link to CL0P. It asks for information and states no link.
CISA and the FBI say the CL0P gang, also known as TA505, began exploiting the MOVEit Transfer flaw CVE-2023-34362 on 27 May 2023 and used a web shell called LEMURLOOT to steal data.
INTERPOL and Ukrainian police report six arrests or suspects in Ukraine in June 2021 in a case about the Clop ransomware. Those pages do not use the name TA505.
CISA and the FBI advise patching internet-facing systems quickly, using phishing-resistant multi-factor authentication and keeping backups that cannot be altered.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.