Also known as: Cl0p, TA505, FIN11, Lace Tempest, DEV-0950, Graceful Spider, UNCA2546, UNCA2582, Spandex Tempest, UNC5833, UNC6016
Profile generated with AI assistance — review before citing.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Supply Chain Compromise
Manipulate products or delivery mechanisms before the victim receives them.
Create or Modify System Process
Create or modify system-level processes like services or daemons for persistence.
Event Triggered Execution
Establish persistence by hooking into system events like WMI subscriptions or traps.
Boot or Logon Autostart Execution
Configure code to run automatically during system boot or user logon.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
SQL injection exploit for CVE-2023-34362 in Progress MOVEit Transfer application used in mass compromise campaign
Zero-day exploit for CVE-2023-0669 in Fortra GoAnywhere MFT used for initial access
Remote access trojan deployed in Clop operations for persistence and lateral movement
Remote access trojan used by TA505/Clop for initial access and persistence
Legitimate Windows tool abused for script execution and lateral movement
Backdoor with tunneling capabilities used for persistent access
Fortra GoAnywhere managed file transfer software exploited via CVE-2023-0669 zero-day
Progress MOVEit Transfer software exploited via CVE-2023-34362 zero-day SQL injection vulnerability
Cleo managed file transfer software exploited via CVE-2024-50623 zero-day vulnerability
Web shell exploiting MOVEit Transfer vulnerabilities for data exfiltration
Web shell used to exploit MOVEit Transfer vulnerabilities and exfiltrate sensitive data
Custom loader used by Clop operators to deploy ransomware payloads and evade detection
Legitimate file synchronization tool abused by Clop operators for data exfiltration
Malware used for initial access and persistence in some Clop-related campaigns
Legitimate SSH client used for secure tunneling and lateral movement
Ransomware variant occasionally deployed alongside or instead of Clop
Exploit tool used to leverage vulnerabilities in file transfer applications
PowerShell-based command and control framework used in Clop operations
| Type | Value |
|---|---|
| domain | clop-leaks[[.]]com |
| domain | sanjonmta[[.]]com |
| domain | fishingworld[[.]]club |
| hash | 0f0ff752b95e76a5745a689349e5b2ac |
| hash | 4d32c791b99f72f88c2a5cfa7b99f3e1f5f5b3d1a2e5e8f9d2b3c4d5e6f7a8b9 |
| hash | 8c5f0d7f8e2b4a3c9d1e5f7a8b6c4d2e |
| ip | 185[.]140[.]53[[.]]140 |
| ip | 91[.]212[.]166[[.]]109 |
| url | hxxp[://]ekfhzmslekfczawl[[.]]onion |
| hash | c14b96b706e9bb2f6dd00c42a2a62f82e3f2f2a1 |
| domain | support@pubstorm[.]com |
| domain | support@pubstorm[.]net |
| ip | 185[.]245[.]77[.]93 |
| ip | 194[.]87[.]106[.]6 |
| domain | clop-leaks[.]com |
| domain | cl0p-leaks[.]com |
| domain | cl0p[.]net |
| hash | 4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 |
| hash | e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 |
| hash | 4b5f8c4d6e8b3a2d1f9c7e5a3b1d8f6c4e2a9b7d5f3c1e9a7b5d3f1c9e7a5b3d |
| domain | sanwai[.]net |
| Domain / Host | Status |
|---|---|
clop-leaks[.]comClop ransomware data leak site (historical) | offline |
sanjonmta[.]comC2 domain associated with Clop operations | offline |
fishingworld[.]clubC2 infrastructure used in TA505/Clop campaigns | offline |
185[.]140[.]53[.]140C2 server IP associated with Clop infrastructure | active |
91[.]212[.]166[.]109Historical Clop C2 infrastructure | offline |
ekfhzmslekfczawl[.]onionClop ransomware Tor payment/negotiation site | active |
oa[.]88tech[.]me | offline |
xbox-ms-store-debug[.]com | offline |
ms-pipes-service[.]com | offline |
pubstorm[.]com | active |
pubstorm[.]net | active |
support@pubstorm[.]com | unknown |
support@pubstorm[.]net | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
CISA Alert: Clop Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Microsoft Threat Intelligence: Lace Tempest (Clop)
https://www.microsoft.com/en-us/security/blog/2023/06/14/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Mandiant: FIN11 and Clop Ransomware
https://www.mandiant.com/resources/blog/fin11-email-campaigns-precursor-for-ransomware-data-theft
CrowdStrike: Clop Ransomware Analysis
https://www.crowdstrike.com/blog/how-to-defend-against-clop-ransomware/
MITRE ATT&CK: Clop Group Profile
https://attack.mitre.org/groups/G0082/
Secureworks: Clop Ransomware Analysis
https://www.secureworks.com/research/clop-ransomware
Huntress: MOVEit Zero-Day Exploitation by Clop
https://www.huntress.com/blog/moveit-zero-day-findings
Palo Alto Networks: Clop Ransomware Timeline
https://unit42.paloaltonetworks.com/clop-ransomware/
Clop Ransomware Gang Exploiting MOVEit Transfer Vulnerability
https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
Understanding the Clop Ransomware Threat
https://www.cisa.gov/stopransomware/clop-ransomware
Understanding the Clop Ransomware Attacks on MOVEit
https://www.microsoft.com/en-us/security/blog/2023/06/14/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2021-34473-cve-2021-34523-and-cve-2021-31207/
Microsoft Threat Intelligence: Lace Tempest Exploits MOVEit CVE-2023-34362
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-uses-moveit-vulnerability-for-mass-exploitation/
Clop Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-345a
Clop Ransomware Gang Activity Analysis
https://www.mandiant.com/resources/blog/fin11-email-campaigns-precursor-ransomware
Understanding Ransomware Threat Actors: Clop
https://www.sentinelone.com/labs/clop-ransomware/
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
Ransomware Attacks Against the US: 2026 Insights - Bitdefender
https://www.bitdefender.com/en-us/blog/businessinsights/ransomware-attacks-targeting-us-organizations-2026
Threat Spotlight: Ransomware and Cyber Extortion in Q1 2025 - ReliaQuest
https://reliaquest.com/blog/threat-spotlight-ransomware-cyber-extortion-q1-2025/
Clop Ransomware Group Exploiting Gladinet CentreStack Servers
https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-gladinet-centrestack-servers-for-extortion/
Cleo File Transfer Vulnerabilities - Cl0P's Latest Attack Vector
https://socradar.io/blog/cleo-file-transfer-vulnerabilities-cl0ps-attack-vector/
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape - Google
https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape
The Clop Ransomware Gang: A Comprehensive Analysis
https://www.mandiant.com/resources/blog/fin11-ta505-trends
MOVEit Transfer Critical Vulnerability Rapid Response
https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
TA505 Threat Actor Profile - Proofpoint
https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader
Clop Ransomware Gang Exploiting GoAnywhere MFT Zero-Day
https://www.mandiant.com/resources/blog/zero-day-goanywhere-mft
TA505 Cybercrime Group
https://attack.mitre.org/groups/G0092/
Clop Ransomware Exploits Cleo Zero-Day Vulnerability
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
The Evolution of the Clop Ransomware Group
https://www.mandiant.com/resources/blog/evolution-of-clop-ransomware
Cl0p Ransomware Analysis and Detection
https://www.sentinelone.com/labs/cl0p-ransomware-analysis-and-detection/
Clop Ransomware Analysis - CISA
https://www.cisa.gov/sites/default/files/publications/MAR-10322463-1.v1.CLEAR_.pdf
TA505 and Clop Ransomware Connection Analysis
https://www.proofpoint.com/us/blog/threat-insight/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader
Microsoft Threat Intelligence - Lace Tempest Clop Ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-and-moveit-technical-analysis/
Clop Ransomware: Analysis and Detection
https://www.cisa.gov/stopransomware/ransomware-clop
Microsoft Threat Intelligence: Clop ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-and-moveit-transfer/
Mandiant: Zero-Day Vulnerabilities Exploited by Clop
https://www.mandiant.com/resources/blog/zero-day-moveit-clop
Clop Ransomware: From Nuisance to National Security Threat
https://www.mandiant.com/resources/blog/fin11-clop-ransomware
Microsoft: Lace Tempest Exploiting MOVEit Transfer Vulnerability
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-behind-moveit-breach/
TA505 Group Continues Campaigns with SDBbot and FlawedAmmyy
https://www.proofpoint.com/us/blog/threat-insight/ta505-continues-target-retail-and-restaurant-sectors
Clop Ransomware: A Deep Dive
https://www.mandiant.com/resources/blog/clop-ransomware
Clop Ransomware: TA505 Cybercrime Group
https://www.mandiant.com/resources/blog/fin11-ta505-clop-ransomware
Playing Devil's Advocate: The Dark Knight, TA505 and the Clop Ransomware
https://www.sentinelone.com/labs/ta505-apt-cybercrime-and-the-evolution-of-big-game-hunting/
Cactus Ransomware: Prickly New Variant Blooms in Collaboration with Clop Affiliate
https://www.arctic-wolf.com/resources/blog/cactus-ransomware-prickly-new-variant/
Microsoft: Clop ransomware gang behind MOVEit mass-hacks
https://www.bleepingcomputer.com/news/security/microsoft-clop-ransomware-gang-behind-moveit-mass-hacks/
Clop Ransomware Gang Exploiting MOVEit Transfer Zero-Day
https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
Clop Ransomware: Behind the MOVEit Breach
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-behind-the-moveit-breach/
TA505 Exploiting SolarWinds Serv-U Vulnerability
https://www.mandiant.com/resources/blog/fin11-ta505-cyberattacks
Analyzing the Clop Ransomware Operation
https://www.microsoft.com/en-us/security/blog/2023/06/14/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2021-26855-and-cve-2021-27065/
Clop Ransomware: Tactics, Techniques and Procedures
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware/
Clop Ransomware Gang Claims Cleo Data Theft Attacks
https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-claims-cleo-data-theft-attacks/
Clop Ransomware: A Continuing Threat
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
TA505: A Brief History of Their Time
https://www.proofpoint.com/us/blog/threat-insight/ta505-brief-history-their-time
Microsoft Threat Intelligence: Clop (Lace Tempest)
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-campaign-targets-moveit-transfer-tool/
The Evolution of Clop Ransomware
https://www.secureworks.com/research/threat-profiles/gold-tahoe
TA505 Group Analysis
https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/
Clop Ransomware: Analysis and Detection
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-gang-exploits-moveit-zero-day/
Microsoft Threat Intelligence: Lace Tempest profile
https://www.microsoft.com/en-us/security/blog/threat-intelligence/lace-tempest
Microsoft Threat Intelligence: Lace Tempest Profile
https://www.microsoft.com/en-us/security/blog/2023/06/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/
Microsoft: Clop ransomware exploits MOVEit zero-day vulnerability
https://www.microsoft.com/en-us/security/blog/2023/06/01/clop-ransomware-exploits-moveit-zero-day-vulnerability/
Mandiant: Zero-Day Exploitation of Accellion FTA by Clop
https://www.mandiant.com/resources/blog/zero-day-exploitation-of-accellion-fta
MOVEit Transfer Critical Vulnerability Exploitation - CISA
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
Microsoft Threat Intelligence on Lace Tempest Clop Operations
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-group-targets-moveit-transfer/
Threat Actor Profile: TA505, From Dridex to Global Ransomware
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta505-dridex-globimposter
Clop Ransomware: Tactics, Techniques and Procedures
https://www.sentinelone.com/labs/clop-ransomware-tactics-techniques-and-procedures/
Microsoft: Lace Tempest Exploiting MOVEit Transfer
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-gang-exploits-moveit-vulnerability/
Clop Ransomware: Analysis and Mitigation Guidance
https://www.mandiant.com/resources/blog/fin11-ta505-targeting-telecommunications
The Evolution of the Clop Ransomware Group
https://www.sentinelone.com/labs/the-evolution-of-clop-ransomware/
Microsoft Threat Intelligence: Clop ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-exploiting-moveit-transfer-vulnerability/
Clop Ransomware: The Data Exfiltration Group
https://www.coveware.com/blog/2021/3/1/clop-ransomware
Cl0p Ransomware Gang Exploiting GoAnywhere MFT Zero-Day
https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-exploiting-goanywhere-mft-zero-day-since-february/
Clop Ransomware: Analysis and Mitigation Guidance
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-gang-exploiting-moveit-transfer-zero-day/
TA505 and Clop Ransomware Connection
https://www.proofpoint.com/us/blog/threat-insight/ta505-exploits-solarwinds-serv-u-vulnerability-distribute-ransomware
The Clop Ransomware: A Comprehensive Analysis
https://www.ic3.gov/Media/News/2023/230608.pdf
Clop Ransomware: Technical Analysis and Indicators
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
Microsoft Threat Intelligence: Clop Ransomware Operations
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-group-exploits-moveit-transfer-zero-day/
Microsoft Threat Intelligence: Lace Tempest and Clop Ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/financially-motivated-threat-actors-misusing-app-installer/
The Evolution of Clop Ransomware - Trend Micro
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop
MOVEit Transfer Critical Vulnerability - Progress Software
https://www.progress.com/moveit-transfer-critical-vulnerability
Microsoft Threat Intelligence - Clop Ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-uses-moveit-transfer-zero-day-exploit/
Clop Ransomware Gang Linked to GoAnywhere MFT Zero-Day Attacks
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a
Microsoft Threat Actor Naming: Lace Tempest Clop Ransomware
https://www.microsoft.com/en-us/security/blog/2023/06/14/analyzing-attacks-using-the-Exchange-vulnerabilities-CVE-2022-41040-and-CVE-2022-41082/