Clop
A financially motivated extortion brand known for exploiting one enterprise file transfer or business application at many organisations at once. It has mostly relied on stealing data and not on encrypting it since 2021.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The pattern is many victims from one flaw. CISA and the FBI describe zero-day campaigns against Accellion FTA, Fortra GoAnywhere and MOVEit Transfer.1 The Oracle E-Business Suite campaign followed in 2025, with exploitation from 9 August as a zero-day and extortion emails to executives from 29 September.2 Clop was also reported scanning Gladinet CentreStack servers in December 2025.7
UK organisations are affected. Barts Health NHS Trust said patient and staff data was stolen in the Oracle campaign and sought a High Court order to block publication, while working with NHS England, the NCSC and the Metropolitan Police.3
Backups do not answer this threat, because the leverage is the stolen data. The time between theft and contact can be long too: in the Barts case, theft in August 2025 came to light in November.3
This group turns a single unpatched product into a mailing list of victims. Knowing where file transfer and enterprise application software is exposed, and being able to look back for past compromise, matters more than one patch cycle.
How It Attacks
Combines the FBI and CISA advisory1 with Google's account of the Oracle campaign.2 Mass exploitation campaigns are not hands-on in the same way as typical ransomware, so this is a general pattern.
- 1
Find a Flaw
Exploits a zero-day or recently disclosed flaw in internet-facing software. Google recorded exploitation weeks before Oracle's patch.
- 2
Establish a Foothold
Plants a web shell or in-memory implant, such as LEMURLOOT on MOVEit and the GOLDVEIN and SAGE chain on Oracle EBS.
- 3
Steal in Bulk
Takes large volumes of data. Mandiant described this for the Oracle campaign.8
- 4
Wait, Then Contact
Contacts senior executives, weeks after the theft in the Oracle case, and shows file listings as proof.
- 5
Publish
Threatens publication and uses a leak site. Google notes past campaigns waited several weeks before listing victims.
Key Techniques
From the FBI and CISA advisory,1 and the ATT&CK v20 entry for Clop software.9 Clop has a software entry and is linked to the TA505 group entry.10
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Zero-days in file transfer and business software. |
| T1566.001 | Spearphishing Attachment | Initial Access | TA505 phishing, from its group entry. |
| T1505.003 | Web Shell | Persistence | DEWMODE and LEMURLOOT. |
| T1553.002 | Code Signing | Defense Impairment | Clop software can use code signing. |
| T1685 | Disable or Modify Tools | Defense Impairment | Clop software can uninstall or disable security products. |
| T1614.001 | System Language Discovery | Discovery | Checks keyboard language to avoid Russian-language systems. |
| T1490 | Inhibit System Recovery | Impact | Clop software can delete shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Used in early campaigns. |
Tools Observed
Web Shells and Implants
Malware and Post-Exploitation
From the FBI and CISA advisory1 and Google.2 Google says it could not attribute the Oracle activity to a tracked group, and that CL0P branding has been used by at least one actor with different methods.
Vulnerabilities
CVEs tied to Clop campaigns by the sources we opened. Reporting also covers Accellion FTA and Cleo, and an unidentified flaw in Gladinet CentreStack.1,2,7
Patching a product after a Clop campaign is not enough. Mandiant advised checking for past compromise whenever you patched.8
Key Events
CL0P first appears, evolving from CryptoMix.1
Accellion FTA zero-day campaigns. From 2021, mostly relies on data theft.1
Ukrainian police, with Interpol, US and South Korean partners, arrest six people they allege are part of the gang. Mandiant says it was unclear whether they included FIN11 actors.12
GoAnywhere campaign.1
MOVEit campaign and joint advisory.1
Oracle EBS campaign. Mandiant says Cl0p exploited a zero-day and stole large amounts of data.8 CrowdStrike links GRACEFUL SPIDER with moderate confidence and cannot rule out other actors.13
Barts Health confirms data theft and seeks a High Court order.3 Clop reported targeting CentreStack servers.7
New claims appear, which Cyble describes as unvalidated.4
Check Point records a steep fall as the Oracle campaign wound down.6
BlackFog logs further Clop claims.5
Warning Signs
From Google's guidance on the Oracle campaign2 and the FBI and CISA advisory.1 Treat these as prompts for checking, not proof.
- Unexpected recent templates in Oracle EBS template tables
- Unusual requests to Oracle EBS servlets in web logs
- Outbound connections from EBS servers that have no business need
- Unrecognised administrator accounts on file transfer systems
- Emails to executives claiming data theft, especially with real file listings
Defences That Matter
Know Your Exposed Software
- Inventory assets and authorised software.1
- Patch known exploited vulnerabilities on internet-facing systems first.1
- Track file transfer and enterprise application products as priority assets.
Hunt, Do Not Just Patch
- Check for compromise whenever a campaign is reported, not only after the patch.8
- Restrict outbound internet access from EBS servers where not essential.2
- Audit admin accounts. Accounts can persist after a rebuild if the database is kept.1
Limit What Can Be Taken
- Reduce sensitive data held in file transfer systems and set retention limits.
- Monitor for large outbound transfers.
Prepare for a Data Extortion Email
- Make sure executives know to report extortion emails at once and not reply.
- Plan legal action and notification in advance. Barts Health sought a court order.3
Do You Know Which Internet-Facing Software Could Be Next?
We can help you map and test the exposed systems this group favours, and then help you close the gaps.
Sources
- CISA and FBI: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability, AA23-158A, June 2023
- Google Threat Intelligence Group and Mandiant: Oracle E-Business Suite Zero-Day Exploited in CL0P-Branded Extortion Campaign, 9 October 2025
- The Register: Barts Health seeks High Court block after Clop pillages NHS trust data, 8 December 2025
- The Cyber Express: ShinyHunters, CL0P Return With New Claimed Victims, 26 January 2026
- BlackFog: The State of Ransomware 2026, running log of claimed attacks, read 3 November 2026
- Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
- BleepingComputer: Clop ransomware targets Gladinet CentreStack servers for extortion, 18 December 2025
- Help Net Security: Cl0p exploits Oracle E-Business Suite zero-day, 6 October 2025
- MITRE ATT&CK: Clop (S0611), ATT&CK v20
- MITRE ATT&CK: TA505 (G0092), ATT&CK v20
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- Infosecurity Magazine: Members of Clop Ransomware Gang Arrested in Ukraine, 16 June 2021
- BleepingComputer: Oracle zero-day exploited in Clop data theft attacks since early August, 7 October 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.