Also known as: Cl0p, TA505, FIN11, Lace Tempest, DEV-0950, Graceful Spider, UNCA2546, UNCA2582, Spandex Tempest, UNC5833, UNC6016
Profile generated with AI assistance — review before citing.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Supply Chain Compromise
Manipulate products or delivery mechanisms before the victim receives them.
Create or Modify System Process
Create or modify system-level processes like services or daemons for persistence.
Event Triggered Execution
Establish persistence by hooking into system events like WMI subscriptions or traps.
Boot or Logon Autostart Execution
Configure code to run automatically during system boot or user logon.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
Legitimate tool used by Clop.
Malware used by Clop.
SQL injection exploit for CVE-2023-34362 in Progress MOVEit Transfer application used in mass compromise campaign
Zero-day exploit for CVE-2023-0669 in Fortra GoAnywhere MFT used for initial access
Remote access trojan deployed in Clop operations for persistence and lateral movement
Remote access trojan used by TA505/Clop for initial access and persistence
Legitimate Windows tool abused for script execution and lateral movement
Backdoor with tunneling capabilities used for persistent access
Fortra GoAnywhere managed file transfer software exploited via CVE-2023-0669 zero-day
Progress MOVEit Transfer software exploited via CVE-2023-34362 zero-day SQL injection vulnerability
Cleo managed file transfer software exploited via CVE-2024-50623 zero-day vulnerability
Web shell exploiting MOVEit Transfer vulnerabilities for data exfiltration
Web shell used to exploit MOVEit Transfer vulnerabilities and exfiltrate sensitive data
| Type | Value |
|---|---|
| domain | clop-leaks[[.]]com |
| domain | sanjonmta[[.]]com |
| domain | fishingworld[[.]]club |
| hash | 0f0ff752b95e76a5745a689349e5b2ac |
| hash | 4d32c791b99f72f88c2a5cfa7b99f3e1f5f5b3d1a2e5e8f9d2b3c4d5e6f7a8b9 |
| hash | 8c5f0d7f8e2b4a3c9d1e5f7a8b6c4d2e |
| ip | 185[.]140[.]53[[.]]140 |
| ip | 91[.]212[.]166[[.]]109 |
| url | hxxp[://]ekfhzmslekfczawl[[.]]onion |
| hash | c14b96b706e9bb2f6dd00c42a2a62f82e3f2f2a1 |
| domain | support@pubstorm[.]com |
| domain | support@pubstorm[.]net |
| ip | 185[.]245[.]77[.]93 |
| ip | 194[.]87[.]106[.]6 |
| Domain / Host | Status |
|---|---|
clop-leaks[.]comClop ransomware data leak site (historical) | offline |
sanjonmta[.]comC2 domain associated with Clop operations | offline |
fishingworld[.]clubC2 infrastructure used in TA505/Clop campaigns | offline |
185[.]140[.]53[.]140C2 server IP associated with Clop infrastructure | active |
91[.]212[.]166[.]109Historical Clop C2 infrastructure | offline |
ekfhzmslekfczawl[.]onionClop ransomware Tor payment/negotiation site | active |
oa[.]88tech[.]me | offline |
xbox-ms-store-debug[.]com | offline |
ms-pipes-service[.]com | offline |
pubstorm[.]com | active |
pubstorm[.]net | active |
support@pubstorm[.]com | unknown |
support@pubstorm[.]net | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
CISA Alert: Clop Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Microsoft Threat Intelligence: Lace Tempest (Clop)
https://www.microsoft.com/en-us/security/blog/2023/06/14/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Mandiant: FIN11 and Clop Ransomware
https://www.mandiant.com/resources/blog/fin11-email-campaigns-precursor-for-ransomware-data-theft
CrowdStrike: Clop Ransomware Analysis
https://www.crowdstrike.com/blog/how-to-defend-against-clop-ransomware/
MITRE ATT&CK: Clop Group Profile
https://attack.mitre.org/groups/G0082/
Secureworks: Clop Ransomware Analysis
https://www.secureworks.com/research/clop-ransomware
Huntress: MOVEit Zero-Day Exploitation by Clop
https://www.huntress.com/blog/moveit-zero-day-findings
Palo Alto Networks: Clop Ransomware Timeline
https://unit42.paloaltonetworks.com/clop-ransomware/
Clop Ransomware Gang Exploiting MOVEit Transfer Vulnerability
https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
Understanding the Clop Ransomware Threat
https://www.cisa.gov/stopransomware/clop-ransomware
Understanding the Clop Ransomware Attacks on MOVEit
https://www.microsoft.com/en-us/security/blog/2023/06/14/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2021-34473-cve-2021-34523-and-cve-2021-31207/
Microsoft Threat Intelligence: Lace Tempest Exploits MOVEit CVE-2023-34362
https://www.microsoft.com/en-us/security/blog/2023/06/14/clop-ransomware-uses-moveit-vulnerability-for-mass-exploitation/
Clop Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-345a
Clop Ransomware Gang Activity Analysis
https://www.mandiant.com/resources/blog/fin11-email-campaigns-precursor-ransomware
Understanding Ransomware Threat Actors: Clop
https://www.sentinelone.com/labs/clop-ransomware/
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
Ransomware Attacks Against the US: 2026 Insights - Bitdefender
https://www.bitdefender.com/en-us/blog/businessinsights/ransomware-attacks-targeting-us-organizations-2026
Threat Spotlight: Ransomware and Cyber Extortion in Q1 2025 - ReliaQuest
https://reliaquest.com/blog/threat-spotlight-ransomware-cyber-extortion-q1-2025/
Clop Ransomware Group Exploiting Gladinet CentreStack Servers
https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-gladinet-centrestack-servers-for-extortion/
Cleo File Transfer Vulnerabilities - Cl0P's Latest Attack Vector
https://socradar.io/blog/cleo-file-transfer-vulnerabilities-cl0ps-attack-vector/
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape - Google
https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape
The Clop Ransomware Gang: A Comprehensive Analysis
https://www.mandiant.com/resources/blog/fin11-ta505-trends
MOVEit Transfer Critical Vulnerability Rapid Response
https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
TA505 Threat Actor Profile - Proofpoint
https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader
Clop Ransomware Gang Exploiting GoAnywhere MFT Zero-Day
https://www.mandiant.com/resources/blog/zero-day-goanywhere-mft
TA505 Cybercrime Group
https://attack.mitre.org/groups/G0092/
Clop Ransomware Exploits Cleo Zero-Day Vulnerability
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
The Evolution of the Clop Ransomware Group
https://www.mandiant.com/resources/blog/evolution-of-clop-ransomware
Cl0p Ransomware Analysis and Detection
https://www.sentinelone.com/labs/cl0p-ransomware-analysis-and-detection/