Clop Technical Intelligence Dossier

Executive Summary & Threat Architecture

Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempest) that fundamentally transformed the cyber extortion landscape by pivoting from traditional endpoint encryption to catastrophic zero-day mass data exfiltration and extortion. Emerging around February 2019 as a variant of the CryptoMix ransomware family, Clop operated traditional double-extortion campaigns utilizing RSA-1024 and RC4 encryption to lock corporate servers while threatening to publish stolen records on their 'CL0P^_- LEAKS' portal. However, beginning in late 2020, Clop revolutionized its operational model by targeting enterprise Managed File Transfer (MFT) appliances using weaponized zero-day exploits. Clop executed successive automated mass-exploitation waves targeting Accellion FTA, Fortra GoAnywhere MFT (CVE-2023-0669), and culminating in the historic May 2023 zero-day attack on Progress Software MOVEit Transfer (CVE-2023-34362). In the MOVEit campaign, Clop exploited an unauthenticated pre-auth SQL injection vulnerability to drop custom 'human2.aspx' webshells across thousands of internet-facing enterprise file transfer servers, exfiltrating billions of sensitive records affecting over 2,700 organizations and 90 million individuals worldwide, including government agencies, universities, and healthcare providers. CISA, the FBI, and international partners released Advisory AA23-158A detailing Clop's exploitation of MOVEit Transfer vulnerabilities.

Observed Threat Aliases: Cl0p, Clop Ransomware, CryptoMix Clop, TA505 Clop, Lace Tempest

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: cryptomix

Documented Downstream Variants: clop_v1, clop_moveit_stealer, clop_goanywhere

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Clop operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Pre-authentication SQL injection exploitation of MOVEit Transfer web applications (CVE-2023-34362)
• Remote code execution against Fortra GoAnywhere MFT appliances (CVE-2023-0669)
• Spear-phishing campaigns delivering weaponized Office documents dropping Cobalt Strike or TrueBot

Host Persistence & Execution Hooks

• Deployment of human2.aspx webshells inside MOVEit Transfer wwwroot web directories
• Creation of rogue administrative user accounts in backend application SQL databases
• Scheduled tasks executing PowerShell exfiltration scripts

Reference File Hashes (SHA-256)

• 31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad
• b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025
• 9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420