Search threats, CVEs… ⌘K
← Back to all threat actors

Clop

Also known as Cl0p, CL0P
Tracked as CVE-2026-12569

Clop, commonly stylized CL0P, is a financially motivated extortion operation that emerged in February 2019 from the CryptoMix ransomware lineage. Its tradecraft shifted from phishing-led ransomware deployment toward mass exploitation of managed file-transfer products, rapid data theft, and extortion. Major campaigns have targeted Accellion FTA, GoAnywhere MFT, and MOVEit Transfer.

How we source and review actor profiles
Motivation
ransomware
First seen
2019-02-01
Last seen
2026-10-21
Sectors
technology, professional-services, retail-e-commerce, manufacturing, transportation, financial-services, healthcare, education, agriculture-and-food-production, energy-utilities, hospitality, government-defense
Status
Active

Threat intelligence assessment

At a glance

Facts

  • E-crime group known for ransomware operations
  • Commonly goes inactive between campaigns but springs to life with custom-built web shells for mass exploitation

Activity timeline

Facts

  • Deployed JSP web shells against vulnerable PTC Windchill and FlexPLM instances following CVE-2026-12569 exploitation
  • Attribution highly likely based on references to 'Clop' throughout the web shell

Attribution assessment

Facts

  • Clop previously deployed DEWMODE after exploiting CVE-2021-27101 in Accellion
  • Clop previously deployed LEMURLOOT after exploiting CVE-2023-34362 in MOVEit Transfer

Operational playbook

Stages

  • Identify exposed managed file-transfer products at scale.
  • Exploit product-specific zero-days to place a web shell or gain access to the transfer appliance.
  • Enumerate application databases, cloud-storage settings, user records, and stored files.
  • Create or remove privileged service accounts when needed for access.
  • Exfiltrate files directly from the managed transfer platform, often without lateral movement into the wider network.
  • Research senior contacts, send ransom demands, and threaten publication through the CL0P leak site.

Initial access and identity targets

Facts

  • Exploitation of CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM servers involving improper input validation

Capabilities and evasion

Facts

  • Web shell capable of mapping sensitive vault data
  • Decrypts every credential in the Windchill keystore
  • Runs additional code via custom Java class loader
  • Supports commands for credential harvesting, file enumeration, file download, file deletion, and arbitrary file reading
  • Ability to load and execute Java classes from ZIP via class loader for secondary payload deployment
  • Vault enumeration targeting application database to identify high-value engineering data
  • Executes queries through Windchill's existing database identity to reduce forensic visibility

Infrastructure patterns

Facts

  • Web shell embeds detailed knowledge of PTC Windchill and FlexPLM APIs, database schema, keystore, and file-vault structure

Communication and pressure channels

Facts

  • Extortion emails containing addresses used on the ransomware gang's data leak site

Observed targeting

Facts

  • Targets PTC Windchill and FlexPLM instances used to store engineering data and product designs
  • Focuses on obtaining proprietary data and sensitive credentials for lateral movement

Defender guidance

Facts

  • Web shell blends in with regular Windchill traffic and uses application's own database connections to evade signature-based defenses
  • Movement from initial access through data theft occurs entirely within application's trust boundary with limited forensic visibility

Reported detail

Facts

  • Clop deployed a custom JSP web shell against PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569, designed specifically for those products
  • The web shell decrypts stored credentials including LDAP manager and administrative passwords, enabling potential enterprise-wide compromise
  • It includes commands for credential harvesting, vault enumeration, file operations, and loading arbitrary Java code for secondary payloads
  • The implant operates within the application's process using its own database connections to minimize detectability compared to traditional web shells
  • This represents part of Clop's pattern of developing application-specific web shells when mass-exploitation opportunities emerge in data-rich software

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimLEGAL-RECORDS.US listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator4 indicators cataloged

Types: onion.

First listed
Victim claimALDOGROUP.COM(ALDOSHOES.COM) listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBRILLONCONSUMER.COM(BRILLONCONSUMER.COM) listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSUUNTO.CN(SUUNTO.COM) listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSMAPCENTER-UAH.EDU listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDAD-CO.TH listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCLOUD-CLEARWAYGROUP.COM listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHODERO-HOLDINGS-LTD listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimKVHELI-WORDPRESS.COM listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCCCM-BC.CA listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBRINKS-CO.NZ listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSAUL-ORG.UK listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCCED-COM.OM listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimINFINIGATE.CH(INFINIGATE.CO.UK) listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSWEETLAKE-LAND-AND-OIL-CO-INC listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimKIRKLAND-AND-ELLIS.LLP listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPALIG.COM listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCOLUMBIABANK.COM(UMPQUABANK.COM) listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimUNISALLE-EDU.CO listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimVALLEY-TRUCK-AND-TRACTOR listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimKSS-ARCHITECTS-LLP listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimELANDRETAIL.COM-KMALL24.COM listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTRANSPORT-NSW.GOV.AU listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAMEY-CO.UK listed by Clop

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 114 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

ClopCanonical Name
CL0PAlias
CVE-2026-12569Tracking Id
Overlaps: TA505

Loading CVEs, techniques, indicators, malware, victims, and activity...