What is Clop Ransomware?

Key takeaways

• Clop is a ransomware operation active since 2019, linked to the threat actors tracked as TA505 and FIN11.
• It specializes in mass exploitation of managed file-transfer software, compromising many organizations in a single campaign.
• Clop often uses data-theft extortion, stealing files and threatening to leak them rather than encrypting systems.
• Its MOVEit campaign in 2023 affected hundreds of organizations worldwide through a single zero-day flaw.
• Microsegmentation isolates internet-facing file-transfer systems and restricts the connections used to exfiltrate data.

What is Clop ransomware?

Clop is a ransomware family, and the criminal operation behind it, associated with the financially motivated groups tracked as TA505 and FIN11. It has run both traditional encryption attacks and data-theft-only extortion. Clop is best known for a pattern of finding and exploiting vulnerabilities in widely used file-transfer applications, which lets a single flaw yield access to many victims at once.

Clop first surfaced in February 2019 and has remained active in some capacity since then. One of its most recent campaigns was a large-scale extortion effort against Oracle E-Business Suite customers in 2025, as reported by Google Threat Intelligence Group (GTIG).

How does Clop ransomware work?

Clop works by exploiting internet-facing file-transfer software to steal data at scale. Rather than relying on broad phishing followed by manual movement, Clop campaigns center on zero-day vulnerabilities in managed file-transfer (MFT) products. When operators find a usable flaw, they deploy web shells to the exposed appliance, access the data it holds, and exfiltrate it. Victims then receive extortion demands referencing the stolen files.

For instance, researchers documented Clop deploying a custom backdoor called LEMURLOOT to hold onto access during a notable MOVEit campaign in 2023. Once the data was extracted, the group would typically publish the files it stole on a dark web leak site to pressure victims who refused to pay.

This model concentrates risk in the systems that sit at the network edge and in the connections those systems have to internal data stores. An exposed file-transfer appliance with broad internal reach becomes a single point of large-scale loss.

What were notable Clop attacks?

Clop was responsible for several of the largest data-theft campaigns on record. In 2023, it exploited a zero-day vulnerability in the MOVEit Transfer product, compromising hundreds of organizations across government, finance, healthcare, and other sectors. Earlier campaigns exploited the Accellion File Transfer Appliance and GoAnywhere MFT. Each campaign followed the same pattern: one flaw in widely deployed software, exploited quickly across many victims.

Is Clop ransomware still active?

Clop ransomware remains active. It continues to appear among the more prolific ransomware operations, and it has kept targeting internet-facing enterprise applications, historically file-transfer software, with new exploitation campaigns. Its persistence reflects the effectiveness of the mass-exploitation model, which produces many victims from a single vulnerability with relatively little effort per target.

How have Clop ransomware tactics evolved?

Clop did not begin as a mass-exploitation vehicle. The TA505 attackers who developed Clop used tried-and-true tactics in their early days. They blasted out phishing emails containing malicious attachments that launched loaders named "Get2," which then pulled in additional malware. In many cases, the operators stole credentials or compromised remote access services to move deeper into a network.

The early campaigns involved both encrypting files and stealing data, and the operators also threatened to publicly expose data if the victim did not pay. This three-pronged method of locking the files, stealing the data, and threatening to expose the data is what defined Clop's attack style for its first several years.

A notable shift in tactics occurred when Clop's operators began searching for zero-day vulnerabilities within MFT software applications as opposed to using widespread phishing tactics. GoAnywhere MFT and MOVEit Transfer became the two primary conduits of this new approach. In fact, hundreds of organizations have been impacted by the single MOVEit campaign. Many of these newer campaigns bypassed using encryption altogether and monetized the attack through data theft alone. One vulnerability, deployed against every exposed instance of the same software, now does the work that once took thousands of individual phishing emails.

What should you do after a Clop ransomware attack?

In the wake of a Clop-style ransomware breach, the speed at which you take action matters the most. The first and most important step is to isolate any affected file-transfer applications as well as any other systems that display signs of compromise. This is the first measure to contain the breach and cut off the attacker's access before they can spread further.

Next, proceed with any incident response protocols your teams have built for data exfiltration attacks, not just for the encryption that typically defines a ransomware attack. This might look like the following:

• Ensure all compromised accounts are disabled and update all credentials and access tokens associated with those accounts. Additionally, block all known malicious IPs or domains that may be tied to the Clop campaign.
• Before you start deleting malicious files or rebuilding systems, be sure to capture all log information, memory capture records, and other forensic evidence. It's tempting to clean things up as soon as possible, but this may destroy the record you need for investigation and legal action.
• Pinpoint exactly which systems were accessed and which data was exfiltrated, and identify all users or partners who may have been affected.
• Lastly, thoroughly patch or rebuild every system that was compromised in the ransomware attack. In doing so, be sure to complete any regulatory, customer, and law-enforcement notifications your incident triggers.

This is essentially a triage effort, which is meant to stop the bleeding and document the extent of the damage. However, it does not address the underlying exposure that enabled the attackers to exploit a vulnerable application that had access to multiple areas of your environment. Addressing those structural vulnerabilities and limiting what each system can reach is the corrective measure work that follows triage.

How do you contain a Clop-style attack?

You contain a Clop-style cyberattack by isolating internet-facing file-transfer systems and tightly restricting what they can reach. Because Clop targets exposed appliances and then exfiltrates data, limiting the internal reach and outbound connections of those systems reduces both access and loss.

Microsegmentation solutions place file-transfer appliances in their own isolated zone and permit only the specific connections they require. A compromised appliance cannot pivot into the broader environment, and controls on outbound traffic constrain the paths used to move stolen data out. Visibility into real traffic also surfaces unexpected connections from an edge system, which is often the first sign of exploitation. This is what breach containment looks like when applied to an exfiltration-focused threat.

Frequently asked questions about Clop ransomware

What type of malware is Clop?

Clop is ransomware, though many of its campaigns rely on data theft and extortion rather than encrypting victim systems.

How does Clop compromise so many organizations at once?

Clop exploits zero-day vulnerabilities in widely used managed file-transfer software, which lets a single flaw provide access to many organizations in one campaign.

Is Clop still active?

Yes. Clop is still an active ransomware operation, and the threat actors behind the group continue to carry out large-scale exploitation campaigns against internet-facing enterprise applications, historically file-transfer software.

Can microsegmentation stop a Clop-style attack?

Yes. Microsegmentation isolates internet-facing file-transfer systems, limiting the damage if one of these applications is exploited. Additionally, microsegmentation limits the number of potential paths that attackers have available when they attempt to exfiltrate stolen data.