# What is Cl0p ransomware?

Cl0p, also written Clop, is a ransomware and extortion operation that security agencies associate with a criminal group tracked as TA505. It is best known for mass data theft through flaws in file-transfer software rather than for classic encryption. CISA and the FBI described its exploitation of a zero-day vulnerability, CVE-2023-34362, in the MOVEit Transfer product in joint advisory AA23-158A of 7 June 2023: from late May 2023 the group stole data from a large number of organisations through that one product, then demanded payment to keep it unpublished. Earlier campaigns had used similar flaws in other managed file-transfer products. For a small company the lessons are specific: know which file-transfer and other internet-facing applications you run, including those operated by suppliers on your behalf, patch them as soon as an advisory appears, and watch for unusual volumes of data leaving those servers. Encryption is not required for serious harm.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-cl0p-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is BianLian ransomware?](https://netsenx.com/en/faq/what-is-bianlian-ransomware)
- [What was Hive ransomware?](https://netsenx.com/en/faq/what-was-hive-ransomware)
- [What was Conti ransomware?](https://netsenx.com/en/faq/what-was-conti-ransomware)
- [What are Phobos and 8Base ransomware?](https://netsenx.com/en/faq/what-are-phobos-and-8base-ransomware)
- [What is Ghost, or Cring, ransomware?](https://netsenx.com/en/faq/what-is-ghost-cring-ransomware)