Clop
Clop is a ransomware group with a financial motive, tracked by Brandefense. It targets 20 sectors, including Government and Technology, in 65 countries, including the United States and the United Kingdom. It uses 91 MITRE ATT&CK techniques and exploits 31 known CVEs.
- Lace Tempest
- Techniques
- 91
- Exploited CVEs
- 31
- First seen
- Mar 13, 2020
- Last seen
- Aug 14, 2026
- Record updated
Who They Target.
About Clop.
The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505. At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware. After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp,.Cllp, and.C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.