Cl0p ransomware: The skeezy invader that bites while you sleep

Cl0p ransomware is a private ransomware operation run by an organized cybercrime group known as TA505. The Cl0p operation is just one of several units of the TA505 criminal enterprise, and it is thought to be the most profitable. Since its emergence in 2019, Cl0p has extorted over $500 million in ransom payments and has directly affected thousands of organizations and tens of millions of individuals globally. In the final quarter of 2024, Cl0p outpaced Akira and overtook RansomHub to become the most active ransomware group in the landscape. In the first quarter of 2025, Cl0p surpassed LockBit as the most prolific ransomware group, based on publicly disclosed breaches.

Researchers believe the brand name comes from the Russian word ‘клоп’, or ‘klop,’ which translates to ‘bedbug’ in English. Like Rhysida, Medusa and BianLian, the name is probably meant to convey the characteristics adopted by the group. Most analysts have said the small but mighty (and gross) bedbug is supposed to represent stealth and persistence.

Cl0p is also stylized as Clop or CLOP, but the group often refers to itself with a zero (0) replacing the letter ‘o.’ This is an old school evasion tactic to slide past keyword filters that wouldn’t recognize the similarities between Clop and Cl0p, and it’s a nod to the hacker practice of replacing letters with numbers and symbols. The group doesn’t seem too committed to this though, because they’ve also used  their ransom notes using CLOP^_ , Clop, and C|0p. 

Who is Cl0p?

To answer this question, we start with the cybercriminal enterprise known as TA505. This is a Russian-speaking group that has been active since 2014, conducting attacks with several malware families including Dridex and Locky. Aside from Cl0p, TA505's criminal activities include initial access brokering (IAB), phishing and malspam distribution at scale, financial fraud, and large-scale botnet operations.

The Cl0p ransomware strain surfaced in 2019 and is thought to have evolved from CrypBoss and CryptoMix ransomware. These two strains emerged in 2015 and 2016 and had died off by 2018. Some researchers believe Cl0p is a direct successor to CryptoMix, but it seems more likely that the earlier operators split into several different RaaS groups. Whatever the origin story, Cl0p ransomware has endured and adapted, and is now considered the ‘flagship’ of the TA505 operations. It’s the most well-known attack tool in their arsenal, and it demonstrates the group’s technical sophistication and adaptability in attack methods. Cl0p has inflicted significant damage across the world through its high-profile supply chain attacks.

Researchers put TA505 and Cl0p ransomware in Russia or the Commonwealth of Independent States (CIS). Cl0p ransomware is specifically programmed not to execute on Russian-language systems, and the group’s communications and code comments contain Russian language elements and cultural references. Command-and-control servers and payment infrastructure elements have been traced back to Russia and Eastern Europe.

Cl0p actors also avoid attacking targeting organizations within Russia and former Soviet states, and their activity patterns have been observed to be in alignment with working hours in Eastern European time zones.

Despite the probable Russian origin, Cl0p actors make it clear they are not hacktivists or affiliated with any nation-state. 

Cl0p's ransom notes may also emphasize the group’s financial motivation: 

“We do not want to make this public or spread your confidential information, we are only interested in money.

We are not interested in political speak just money and money will bring this to finish.” ~via Ransomware.Live

Considering these statements and a lack of evidence to the contrary, researchers believe Cl0p is motivated by financial gain and has no political objectives.

Cl0p operations

Cl0p is a private ransomware operation with a core team handling most aspects of their campaigns. In most major attacks, especially those involving zero-day vulnerabilities, the core TA505 team maintains end-to-end control. For certain operations, Cl0p has selectively employed an affiliate model, where trusted partners are granted limited use of their ransomware code in exchange for a percentage of ransom proceeds. This may be the case when Cl0p / TA505 has a specific operation in mind and the group needs more ‘hands on deck’ to get the job done.

This flexible approach puts Cl0p somewhere between pure Ransomware-as-a-Service (RaaS) operations that rely on affiliates, and private ransomware groups that operate exclusively as closed teams. Some researchers and industry analysts refer to Cl0p as a RaaS operation because Cl0p does use affiliates as needed.

Cl0p also stands out for several other reasons. The group specializes in exploiting previously unknown zero-day vulnerabilities, which they’ve successfully deployed in several supply chain attacks. They use aggressive extortion tactics, including encryption, data exfiltration, distributed-denial-of-service (DDoS), and stakeholder harassment. This harassment involves contacting the affected employees, customers, partners, and media to pressure the breached company into paying.

How Does Cl0p Work?

Cl0p’s primary distribution and infection methods have evolved from sophisticated phishing attacks to advanced zero-day exploits. The phishing campaigns used malicious email attachments, links to compromised sites and a range of social engineering tactics. Cl0p is known to use data stolen from existing victims to create a convincing message and call to action. This makes their attacks more effective against partners, customers, vendors, and others who may offer a pathway into the target’s network.

In Cl0p’s early years, phishing campaigns relied on macro-enabled Microsoft Excel and Word files. These were delivered through an html attachment that redirected the user to the documents, or they were directly attached to the message. 

On devices with macros enabled, the document downloaded the following tools from a Cl0p-controlled server:

• Get2: A malware loader, downloader, or ‘first-stage malware.’ The primary purpose of Get2 is to download and execute other malicious software onto a victim’s server.
• SDBot: This is a family of backdoor Trojans used for remote access and lateral movement. Microsoft has details on the child variants here.
• FlawedAmmyy RAT: A remote access trojan (RAT) used for data theft and command execution.
• ServHelper: A malware family that facilitates remote access and backdoor capabilities.  It also works to harvest credentials and establish persistence of the threat in the system.

Cl0p will also use Initial Access Brokers (IABs) to gain access to targeted organizations.

Cl0p strikes gold with zero-day vulnerabilities

Although Cl0p continues to run phishing attacks, the zero-day attack has become the group’s signature approach. Many ransomware groups exploit known vulnerabilities on unpatched systems. Cl0p has repeatedly developed and deployed exploits against previously unknown vulnerabilities. Here are the big ones:

Accellion FTA (December 2020): This file transfer appliance was nearing end-of-life when several vulnerabilities were identified and exploited by Cl0p. The attack was launched on December 23, right before the U.S. Christmas holiday. The group gained access to approximately 100 organizations that used Accellion FTA. Vulnerabilities: CVE-2021-27101/27102/27103/27104

GoAnywhere MFT (January 2023): Fortra’s Managed File Transfer solution was under active exploitation for two weeks before the vendor realized the breach. Cl0p was able to gain access to over 130 companies through this exploit. Vulnerability: CVE-2023-0669

MOVEit Transfer (May 2023): Cl0p exploited yet another file transfer system service provider at the end of May 2023, during the U.S. Memorial Day holiday. The vulnerability existed in both the cloud and on-premises versions of MOVEit, and Cl0p was able to access thousands of companies, affecting millions of individuals.  You can see a diagram of this supply chain attack here. Vulnerability: CVE-2023-34362

Cleo Software (2024-2025): Cl0p is actively exploiting two vulnerabilities in three Cleo Software products:

• Cleo LexiCom: A desktop client for secure file transfers, normally used to exchange sensitive documents with vendors, customers and other business partners.
• Cleo VLTrader: Server-based managed file transfer (MFT) software that supports multiple protocols for automated workflows.
• Cleo Harmony: An enterprise-grade platform that integrates with enterprise resource planning (ERP) solutions like SAP and Salesforce.

Both vulnerabilities were used to establish backdoors and steal data from Cleo customers. This attack is ongoing as of May 2025. Vulnerabilities: CVE-2024- 50623 /55956.

These four supply chain attacks gave Cl0p access to thousands of victims, and the speed of each attack was important. Most vendors quickly released a patch and communicated with customers, so the window of opportunity for Cl0p was shrinking by the hour. Instead of taking the extra time to encrypt data, Cl0p focused on stealing data and using this and sometimes other types of extortion.

Because speed was so important in these attacks, Cl0p would turn to affiliates to assist in data exfiltration, and this is where the hybrid RaaS model comes into play. The Cl0p core team did not have the capacity to attack all of the potential victims right away, and affiliates can provide a percentage of ransoms from a larger pool of victims. 

Researchers have also noticed patterns in the timing of Cl0p attacks. Phishing emails are sent during the common working hours in the targeted region, so they can snag the most victims while they’re at the desk. Cl0p will attack vulnerabilities during off-hours or long holidays, when IT staff may be reduced or unavailable.

Beyond initial access, the Cl0p attack chain proceeds like this:

• Lateral Movement: Cl0p explores the network with tools like Mimikatz, PsExec, and Cobalt Strike.   
• Evasion and persistence: Cl0p disables Windows Defender and backup processes, and uses code obfuscation to hide indicators of malicious intent.
• Data Exfiltration: Steal sensitive data using custom tools like the Teleport exfiltration tool.
• Encryption: If files are encrypted, they are renamed with extensions clop, CIIp, C_L_O_P, or a similar variation.

Ransom notes are usually named `Cl0pReadMe.txt` or `README_README.txt.’ Victim information is then posted on the Cl0p leak site.

When there is no encryption, Cl0p proceeds with one or more extortion tactics. This could be data leaks, DDoS attacks, or harassment of victims. When ransom negotiations fail, Cl0p makes the data available for download.

Cl0p consistently ranks among the most damaging and adaptive ransomware threats in the cyber landscape. It has the technical abilities to deploy exploits quickly and scale operations as needed. It's also part of a larger group, TA505, which operates a variety of cybercrime operations that can be leveraged on-demand. Resilience, technical innovation, and access to many different resources make Cl0p a serious threat to all companies.

Protect yourself

Following best practices and using multiple layers of security will mitigate the risks. Stay vigilant and apply security patches quickly, especially for all file-transfer solutions and other supply chain software. Solutions like Barracuda Managed XDR can detect these attacks and prevent the encryption and theft of your data.