What is Cl0p ransomware?

Cl0p, also written Clop, is a ransomware and extortion operation that security agencies associate with a criminal group tracked as TA505. It is best known for mass data theft through flaws in file-transfer software rather than for classic encryption. CISA and the FBI described its exploitation of a zero-day vulnerability, CVE-2023-34362, in the MOVEit Transfer product in joint advisory AA23-158A of 7 June 2023: from late May 2023 the group stole data from a large number of organisations through that one product, then demanded payment to keep it unpublished. Earlier campaigns had used similar flaws in other managed file-transfer products. For a small company the lessons are specific: know which file-transfer and other internet-facing applications you run, including those operated by suppliers on your behalf, patch them as soon as an advisory appears, and watch for unusual volumes of data leaving those servers. Encryption is not required for serious harm.

← All 25 questions on Ransomware groups and familiesAll topics