🇷🇺 Cl0p¶
Threat-actor battle card · maintained from public sources · last updated 2026-10-12 · also known as Clop, TA505, FIN11, Snakefly, Graceful Spider
Overview¶
Cl0p (also written Clop) is a Russian-linked data extortion group that emerged in February 2019 as a RaaS ransomware variant evolved from the CryptoMix family. Operated by the TA505 collective (also tracked as FIN11, Snakefly, Graceful Spider), Cl0p pioneered the model of exploiting zero-day vulnerabilities in widely deployed enterprise file-transfer and ERP platforms for mass data theft — targeting thousands of organizations simultaneously through a single vulnerability. Over 1,025 confirmed victims and $500M+ in extorted payments since 2019. Active in 2026 through two overlapping campaigns: residual Cleo file-transfer exploitation (Dec 2024 zero-day; 97+ extortion waves through Q1 2026) and an Oracle E-Business Suite campaign (CVE-2025-61882, CVSS 9.8; exploitation began August 2025; 234+ claimed victims, 103 named on DLS as of early 2026). Food and Agriculture sector targeting emerged as a notable Q1 2026 trend: Cl0p accounted for 9.3% of food/ag attacks globally vs. a 4.2% sector baseline, per Food and Ag-ISAC analysis — consistent with the group's indiscriminate mass-exploitation model reaching ERP deployments in the agri-food supply chain. Not dormant: Harley-Davidson was added to the PTC Windchill/FlexPLM leak site Sep 10, 2026 (~270GB claimed, unconfirmed by the company), and on Oct 8, 2026 a Dutch radio investigation (BNR, via NL Times) confirmed Clop had actually published — not just claimed — stolen Philips data on the dark web, with Shell separately confirming unauthorized access to a third-party cloud platform (see Assessment).
Unusually, Cl0p itself became a victim in September 2026: rival extortion crew ShinyHunters compromised Cl0p's Tor leak site (~Sep 18) by exploiting an unauthenticated file-upload flaw (CVE-2026-42608) in the outdated Grav CMS branch (1.7.43) Cl0p was running, then posted an escalating eight-figure Bitcoin extortion demand against Cl0p itself, threatening to publish records of companies that allegedly paid Cl0p ransoms during the 2025 Oracle EBS campaign. Cl0p briefly posted a short reply asking ShinyHunters to make contact via the old channel but did not address the data/ransom demand; ShinyHunters rejected this and kept demanding payment. If ShinyHunters' claims about stolen negotiation/payment records are real, this is a live risk of outing Cl0p's past paying victims — not yet realized as of this update.
Tradecraft¶
- Zero-day mass exploitation of enterprise file-transfer and ERP platforms: Accellion FTA (2020), SolarWinds Serv-U (2021), GoAnywhere MFT (2023), MOVEit Transfer (2023), Cleo MFT (2024), Oracle E-Business Suite (2025).
- Pure data exfiltration without encryption in recent campaigns — no encryption payload, focus entirely on exfiltration and extortion leverage.
- Quadruple extortion: (1) threat of DLS publication; (2) personal email to victim executives and board; (3) direct contact to victim's customers; (4) selling stolen data to third parties if ransom refused.
- Initial access historically via spear-phishing (SDBot + FlawedAmmy RAT); pivot to zero-day exploitation for mass campaigns since 2020.
- Cobalt Strike for C2 in legacy operations; recent campaigns are primarily network-level exploitation with no persistent implant required.
- Exploits vulnerabilities 1–2 months before public disclosure and patch (CVE-2025-61882: exploited from August 2025; patches released September/October 2025).
- Ransom demands reach $50M (Oracle EBS campaign); seven- and eight-figure demands documented.
- Infrastructure hygiene gap exposed Sep 2026: its own Tor leak site ran an outdated, unpatched Grav CMS (1.7.43), letting a rival group in via an unauthenticated file-upload/path-traversal flaw (CVE-2026-42608) — the same class of avoidable exposure Cl0p routinely exploits in victims.
Notable victims¶
- PTC Windchill/FlexPLM campaign (2026): Shell (unauthorized access to a third-party cloud platform now confirmed Oct 9, 2026; 89GB engineering data claimed, publication itself unverified for Shell specifically), Philips (data actually published and independently reviewed by Dutch journalists Oct 8, 2026 — technical drawings of MRI scanners and IT-infrastructure details; company declines to discuss substance, says no personal/patient data involved), General Electric, FIS Global (874GB claimed), Zebra Technologies (8TB claimed — largest volume in campaign), Fiserv (denies customer data compromise), Harley-Davidson (added Sep 10, 2026; ~270GB claimed, unconfirmed), and 38+ additional organizations named on DLS. Exploitation of CVE-2026-12569 (CVSS 9.3) via JSP webshells since early June 2026; data exfiltration-only (no encryption). Victim count still described as "40+" in most recent (September) trade-press coverage — no firm count above the prior 44+ found.
- Oracle EBS campaign (2025–2026): Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, GlobalLogic (Hitachi subsidiary), Barts Health NHS Trust (London), University of Phoenix (3.5M individuals), Copeland, Schneider Electric; 103+ organizations named on DLS, 77 datasets released via torrent.
- MOVEit (2023): British Airways, BBC, Boots, Shell, US Department of Energy, multiple US state governments; est. 2,000+ organizations affected globally.
- GoAnywhere MFT (2023): Procter & Gamble, City of Toronto, Hitachi Energy, Community Health Systems.
- Cleo MFT (2024–2026): 97+ victims in extortion wave continuing through Q1 2026.
Assessment¶
Cl0p's operational model — stockpiling zero-days in enterprise platforms used for bulk data processing — makes it episodically devastating at a scale no individual target can anticipate or prevent. The PTC Windchill/FlexPLM campaign (CVE-2026-12569, exploited since early June 2026) remains the group's most significant wave since MOVEit 2023 by victim count and sector breadth: 44+ named organizations across industrial (Shell, GE, Zebra Technologies), financial technology (FIS Global, Fiserv), healthcare technology (Philips), and others. The campaign's focus on PLM platforms — which hold CAD files, engineering drawings, proprietary manufacturing data, and product R&D — represents a deliberate pivot to high-value industrial IP exfiltration, potentially enabling follow-on economic espionage or sale to state actors. As of Oct 2026 the campaign has moved from claim to confirmed consequence for at least two named victims (Shell, Philips — see Notable victims), evidence this wave is still live, not dormant, roughly four months after it first surfaced. The ShinyHunters compromise of Cl0p's own leak site is a distinct, second story worth tracking independently: if the rival group's claimed theft of negotiation/payment records holds up, it could retroactively expose which of Cl0p's past victims paid — a reputational and legal risk for those companies regardless of Cl0p's own fate. Best enterprise mitigations: isolate PTC Windchill/FlexPLM from internet-facing networks, monitor for large outbound exfiltration via JSP execution, and maintain tested incident-response playbooks. No named CTI vendor (Mandiant/Halcyon/CrowdStrike) has published new Cl0p-specific attribution reporting since mid-2026; the Windchill campaign's attribution to Cl0p/TA505/FIN11/Lace Tempest remains informal trade-press consensus rather than a fresh named vendor report.
Sources¶
- BleepingComputer — Clop ransomware targets Windchill, FlexPLM in data theft attacks (August 2026)
- CISO Platform — Breach Watch August 17, 2026: Clop Hits Shell, GE, Philips via PTC Windchill Flaw
- DEXpose — Clop Ransomware Targets Zebra.com in Major Data Breach
- Ransom-ISAC — Cl0p Exploitation of PTC Windchill & FlexPLM
- Tech Insider — Cl0p Ransomware Hits PTC Windchill: CVE-2026-12569
- Google Mandiant — Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
- CISA / FBI — #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit
- SecurityWeek — Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site
- Halcyon — Cl0p threat group
- Blackpoint Cyber — Cl0p Ransomware Threat Profile (Feb 2026)
- Industrial Cyber / Food and Ag-ISAC — Cl0p among top ransomware threats to food and agriculture sector (Q1 2026)
- Cybernews — Harley-Davidson added to Clop's Windchill leak site (Sep 2026)
- NL Times — Russian hackers publish stolen Shell, Philips data on dark web (Oct 8, 2026)
- Computable — Gestolen data van Philips en Shell online (Oct 9, 2026)
- BleepingComputer — ShinyHunters hacks Clop leak site, threatens to extort ransomware gang (Sep 2026)
- BleepingComputer — ShinyHunters hacked Clop leak site using Grav CMS path-traversal flaw (Sep 2026)
- Dark Reading — ShinyHunters hacked Clop, what about Clop's victims? (Sep 2026)
⏳ Ongoing cases¶
- Aug 13Claimed by actor 🟥 Clop lists Shell on DLS in the same PTC Windchill/FlexPLM campaign; ~89GB of engineering drawings, facility photos, test-report scans and project plans claimed. Shell confirms it is investigating. Catch-up open (F-24), same Oct8 trigger as Philips. NL Times
- Oct 09Victim confirmed 🟨 Shell confirms unauthorized access occurred to a cloud platform operated by an external party used for non-critical business activities -- no operational consequences, no sensitive personal data exposed. Distinct from a confirmed leak: BNR (per NL Times) could not access Shell's claimed 89GB dataset specifically, so publication itself remains unverified for Shell even though the underlying incident is now company-confirmed. Computable
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
August 2026
July 2026