Log in Request a demo

Ransomware group profile

Cl0p

Also known as CL0P, Clop, TA505

Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505.

  • Active

In short

Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. It is best known for stealing data from many organizations at once by exploiting flaws in file transfer software, including Accellion, GoAnywhere and MOVEit.

Profile MapRansomware Group
  1. StatusActiveas reported
  2. Other Names3names in public reportsCL0P · Clop · TA505
  3. Entry Routes5ways inWeb shells to steal data · Phishing campaigns · Access brokering
  4. Techniques4mapped to MITRE ATT&CKData Encrypted for Impact
  5. Defences6first steps listedRestrict RDP and PowerShell · Check for new accounts

Overview

Cl0p (also written CL0P or Clop) is a ransomware operation first seen in February 2019. A joint advisory (AA23-158A, released June 7, 2023, revised 16 June 2023) from the FBI and CISA says the Cl0p gang is also known as TA505. It evolved from an older ransomware called CryptoMix and was first offered as ransomware as a service (RaaS), where the developers rent the malware to others.

What makes it distinct

Cl0p is best known for mass theft from file transfer software. These are products companies use to send large files to partners. The advisory describes a pattern: find a previously unknown flaw (a zero-day) in one product, break into many customers at once, steal the data, then email the executives. It lists campaigns against Accellion file transfer appliances in 2020 and 2021, GoAnywhere servers in early 2023, and MOVEit Transfer from May 2023. Since 2021 the advisory says Cl0p has relied mostly on stealing data rather than encrypting it.

The 2023 campaigns

In late January 2023, Cl0p used a zero-day, now CVE-2023-0669, against GoAnywhere. The group claimed data from about 130 victims over 10 days. The advisory says no spread into victim networks beyond the platform was identified. Ransom notes then went to senior executives and threatened to publish the stolen files.

Beginning on May 27, 2023, the advisory says, Cl0p began exploiting a previously unknown SQL injection flaw in MOVEit Transfer (CVE-2023-34362). It installed a web shell named LEMURLOOT, which it used to steal data from the underlying databases. The web shell first appeared under the name human2.aspx to blend in with a genuine file.

Scale and background

The advisory says TA505 is estimated to have compromised more than 3,000 US-based and 8,000 global organizations over time. It has also acted as an initial access broker, selling access to compromised corporate networks, and has run phishing and malspam on a large scale. Its toolkit includes FlawedGrace and SDBot remote access tools and Cobalt Strike.

The Cleo campaign, December 2024

In December 2024, flaws in Cleo Harmony, VLTrader and LexiCom file transfer products were exploited (CVE-2024-50623 and CVE-2024-55956), and CISA added both to its Known Exploited Vulnerabilities catalog. A California state advisory says multiple sources confirmed ransomware attacks using these flaws, possibly including Cl0p. See the incident page for the full account.

Law enforcement

INTERPOL reported on 5 November 2021 that six members of a ransomware family had been arrested in Ukraine in June 2021 in Operation Cyclone, coordinated with Korean, Ukrainian and US police. INTERPOL ties the operation to attacks by the Cl0p group. It says the suspects are thought to have helped move and cash out funds for the group. The sources opened for this page do not describe any later action that ended Cl0p operations.

Cl0p timeline
  1. February 2019First seenCl0p appears, evolving from CryptoMix, per the advisory and MITRE ATT&CK.
  2. 2020 to 2021Accellion campaignTA505 installs the DEWMODE web shell on Accellion file transfer appliances.
  3. June 2021Arrests in UkraineSix people are arrested in Operation Cyclone, per INTERPOL.
  4. Late January 2023GoAnywhere zero-dayCl0p exploits CVE-2023-0669 and claims about 130 victims.
  5. May 27, 2023MOVEit exploitation beginsThe advisory dates exploitation of CVE-2023-34362 from this day.
  6. June 7, 2023AdvisoryAA23-158A released, revised 16 June 2023.
  7. December 2024Cleo flaws exploitedCISA adds two Cleo flaws to its catalog on December 13 and 17.

At a glance
Also known as
TA505 (per the advisory)
First seen
February 2019
Origin
Evolved from CryptoMix
Known for
Zero-day theft from file transfer software
Main advisory
AA23-158A, June 7, 2023
Web shells
DEWMODE, LEMURLOOT
Arrests
Six in Ukraine, June 2021 (INTERPOL)

Also known as

  • CL0P
  • Clop
  • TA505

How they get in

  1. 01

    Zero-day in file transfer software

    Cl0p exploited unknown flaws in Accellion FTA (2020 to 2021), GoAnywhere MFT (CVE-2023-0669) and MOVEit Transfer (CVE-2023-34362).

  2. 02

    Web shells to steal data

    DEWMODE on Accellion servers and LEMURLOOT on MOVEit Transfer let the actors run commands and pull data from databases.

  3. 03

    Phishing campaigns

    In 2019, TA505 used Cl0p as the final payload of a phishing campaign with a macro-enabled document.

  4. 04

    Access brokering

    TA505 has sold access to compromised corporate networks and has bought access from others.

  5. 05

    Cleo file transfer flaws

    A California advisory says ransomware attacks using the Cleo flaws (December 2024) possibly included Cl0p.

How they extort

Data theft first. Per the advisory, since 2021 Cl0p has relied mostly on exfiltration over encryption. Ransom notes go to senior executives of victim companies and threaten to publish the stolen files on the Cl0p leak site if no payment is made. Earlier campaigns also used double extortion.

How to defend

  1. Know every file transfer product you run

    Take an inventory of assets, data, and authorized and unauthorized devices and software.

  2. Patch fast and assess regularly

    Regularly patch and update software and run vulnerability assessments.

  3. Audit and limit remote access tools

    Review logs for abnormal use of remote access software and only allow approved remote access over a VPN or virtual desktop.

  4. Restrict RDP and PowerShell

    Strictly limit RDP, apply phishing-resistant MFA, and restrict PowerShell to the users who need it.

  5. Check for new accounts

    Review domain controllers, servers and workstations for new or unrecognized accounts and audit privileged accounts.

  6. Keep offline backups and a recovery plan

    Keep multiple copies of important data in a separate, secure place, and test restores.

Questions

What is Cl0p ransomware?

Cl0p is a ransomware operation first seen in February 2019, also known as TA505 per a joint FBI and CISA advisory (AA23-158A). It evolved from an older ransomware called CryptoMix and is best known for mass data theft from file transfer software.

How does Cl0p attack file transfer software?

The advisory describes a pattern: find a previously unknown flaw (a zero-day) in one product, break into many customers at once, steal the data, then email executives. Campaigns named include Accellion in 2020 and 2021, GoAnywhere in early 2023 and MOVEit from May 2023.

Does Cl0p still encrypt files?

The advisory says that since 2021 Cl0p has relied mostly on stealing data rather than encrypting it. Ransom notes then go to senior executives and threaten to publish the stolen files.

Is Cl0p still active?

The page lists Cl0p as active. INTERPOL reported arrests of six members of a ransomware family in Ukraine in June 2021, tied to Cl0p, but the sources opened for the page describe no later action that ended Cl0p operations.

In our research

  1. Exploited vulnerabilities in 2025: what ENISA reports October 2026
  2. FIN11 (DEV-0950 / Lace Tempest / TA505 / TEMP.Warlock / UNC902): A 1000-Word Intelligence January 2026
  3. What Should You Know About Ransomware September 2022
  4. TA505 Threat group

Sources

  1. #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A) CISA and FBI
  2. INTERPOL-led operation takes down prolific cybercrime ring INTERPOL
  3. Cleo's Harmony, VLTrader and Lexicom Multiple Zero-Day Vulnerabilities California Governor's Office of Emergency Services
  4. CISA Adds One Known Exploited Vulnerability to Catalog (13 December 2024) CISA
  5. CISA Adds One Known Exploited Vulnerability to Catalog (17 December 2024) CISA
  6. Clop, Software S0611 MITRE ATT&CK
  7. TA505, Group G0092 MITRE ATT&CK

Last updated 7 October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more