Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
English
Entry № 179

Cl0p / Clop Ransomware

What is Cl0p / Clop Ransomware?

Cl0p / Clop RansomwareA ransomware and data-extortion crew tracked as TA505 / FIN11 that mass-exploited file transfer zero-days, most notably MOVEit Transfer in 2023.

Cl0p, also written Clop, is a ransomware and data-extortion operation linked to the financially motivated cluster TA505 / FIN11. Active since at least 2019, the group is best known for industrial-scale exploitation of managed file-transfer zero-days: Accellion FTA in 2020 (CVE-2021-27101 et al.), GoAnywhere MFT in 2023 (CVE-2023-0669) and most spectacularly MOVEit Transfer (CVE-2023-34362) in mid-2023, which exposed data from more than 2,500 organizations and over 90 million individuals. Operators emphasize data theft and public extortion via the CL0P^_-LEAKS site, often without deploying ransomware encryption. Victims include US federal agencies, Shell, BBC and British Airways.

● Examples

  1. 01

    Cl0p posts dozens of MOVEit victims on its leak site over several weeks in mid-2023 and threatens to release data unless they negotiate.

  2. 02

    An organization migrates its remaining Accellion FTA workloads to a supported MFT product after Cl0p reuses similar zero-days.

● Frequently asked questions

What is Cl0p / Clop Ransomware?

A ransomware and data-extortion crew tracked as TA505 / FIN11 that mass-exploited file transfer zero-days, most notably MOVEit Transfer in 2023. It belongs to the Malware category of cybersecurity.

What does Cl0p / Clop Ransomware mean?

A ransomware and data-extortion crew tracked as TA505 / FIN11 that mass-exploited file transfer zero-days, most notably MOVEit Transfer in 2023.

How does Cl0p / Clop Ransomware work?

Cl0p, also written Clop, is a ransomware and data-extortion operation linked to the financially motivated cluster TA505 / FIN11. Active since at least 2019, the group is best known for industrial-scale exploitation of managed file-transfer zero-days: Accellion FTA in 2020 (CVE-2021-27101 et al.), GoAnywhere MFT in 2023 (CVE-2023-0669) and most spectacularly MOVEit Transfer (CVE-2023-34362) in mid-2023, which exposed data from more than 2,500 organizations and over 90 million individuals. Operators emphasize data theft and public extortion via the CL0P^_-LEAKS site, often without deploying ransomware encryption. Victims include US federal agencies, Shell, BBC and British Airways.

How do you defend against Cl0p / Clop Ransomware?

Defences for Cl0p / Clop Ransomware typically combine technical controls and operational practices, as detailed in the full definition above.

What are other names for Cl0p / Clop Ransomware?

Common alternative names include: Cl0p, TA505, FIN11.

● Related terms