cl0p

Cl0p (also tracked as TA505, FIN11, Lace Tempest, Storm-1567, DEV-0950, Graceful Spider, Hive0065, Gold Tahoe, and MITRE ATT&CK G1059) represents the most prolific zero-day-exploitation ransomware operation in the publicly-tracked record. The cluster operates from Russia, Ukraine, and adjacent post-Soviet states with operational lineage tracing to approximately 2014 as TA505 malspam-and-banking-trojan operations (Dridex distribution, Locky ransomware operations) evolving into the modern Cl0p ransomware brand emerging in February 2019. Modern vendor consensus tends toward treating TA505, FIN11, Cl0p, and Lace Tempest as alternative names for an overlapping or unified operational cluster within the broader Russia-speaking organized cybercrime ecosystem.

The cluster has executed four major mass-zero-day-exploitation ransomware campaigns against managed-file-transfer and business- application software products, a tradecraft pattern operationally distinctive among publicly-tracked ransomware operations and establishing Cl0p as the central reference for zero-day- exploitation-as-ransomware-tradecraft analytical frameworks: First, Accellion File Transfer Appliance mass-exploitation (December 2020

January 2021) of zero-day vulnerabilities CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, and CVE-2021- 27104. Compromise of 100+ organizations including major US universities (UC system, Stanford, Yeshiva), major US law firms (Jones Day, Goodwin Procter), Reserve Bank of New Zealand, Australian Securities and Investments Commission, Singapore Telecommunications, and Royal Dutch Shell. Second, GoAnywhere MFT mass-exploitation (January-February 2023) of Fortra GoAnywhere MFT zero-day vulnerability CVE-2023-0669. Compromise of 130+ organizations including Procter & Gamble, Hatch Bank, Crown Resorts, Hitachi Energy, Onex Corporation, Atos, and Sun Pharma. Third, PaperCut MF/NG mass-exploitation (April-May 2023) of print-management software zero-day vulnerability CVE-2023-27350. Fourth, and most operationally consequential, MOVEit Transfer mass-exploitation (May-June 2023) of Progress Software MOVEit Transfer zero-day vulnerability CVE-2023-34362 (SQL injection RCE). The MOVEit campaign compromised approximately 2,700+ organizations affecting an estimated 80+ million individuals across US federal-government agencies (Department of Energy, Office of Personnel Management, multiple HHS subsidiaries), state and local governments, major financial institutions (Putnam Investments, TIAA, multiple US public-sector pension funds via Pension Benefit Information aggregation), healthcare organizations (Johns Hopkins University and Health System, BORN Ontario, Maximus), higher education (CSU, Johns Hopkins, University of Georgia), professional-services firms (PwC, EY, Deloitte), and corporations (Shell, British Airways, BBC, Boots, Aer Lingus, Sony, Cognizant, Schneider Electric, Honeywell, Siemens Energy, ABB, Nuance Communications, and many others). The MOVEit campaign used the LEMURLOOT webshell , a custom Cl0p-developed webshell for MOVEit-specific exploitation and data-exfiltration. Estimated total ransom collection has been variously reported at $75-100+ million USD. The campaign's operational scale was unprecedented in the publicly-tracked ransomware record and contributed substantially to elevated US and international policy attention to managed- file-transfer software supply-chain risk. The mass-zero-day-exploitation tradecraft pattern is operationally distinctive among publicly-tracked ransomware operations. Most ransomware operations rely on conventional initial-access tradecraft (phishing, credential-stuffing, exploitation of disclosed n-day vulnerabilities) and target individual organizations via affiliate-led operations. Cl0p's mass-zero-day-exploitation pattern targets large numbers of organizations simultaneously via single zero-day-vulnerability exploitation campaigns, producing dramatically larger operational impact than conventional ransomware operations. The pattern requires sustained zero-day- research-and-weaponization capability, a capability typically associated with state-aligned cluster operations rather than financially-motivated cluster operations. Cl0p's sustained zero- day-development capability represents a meaningful operational- doctrine signal about the cluster's resources and technical maturity, and complicates the conventional financially-motivated- vs-state-aligned categorical framing. Operationally the cluster also operates conventional ransomware- affiliate operations alongside the mass-zero-day-exploitation campaigns. Tooling includes Cl0p ransomware (with Linux + ESXi + macOS cross-platform variants), Truebot, FlawedAmmyy RAT, Get2 downloader, the LEMURLOOT and DEWMODE custom webshells, Amadey loader, SmokeLoader, and selected commodity tools (Cobalt Strike Beacon, Mimikatz, Rclone for data exfiltration). The Ukrainian National Police arrests of six individuals in Kyiv (June 16, 2021) in coordination with US and South Korean law-enforcement disrupted but did not fully eliminate cluster operations. Notably, no formal Khoroshev-style individual- administrator indictment has been publicly issued for Cl0p administrators despite the substantial operational impact of the mass-exploitation campaigns, a notable analytical gap. A handful of operational notes: First, the mass-zero-day-exploitation tradecraft pattern represents one of the most operationally consequential developments in the publicly-tracked ransomware ecosystem of the 2020-2024 period. The Accellion, GoAnywhere, MOVEit, and PaperCut campaigns collectively demonstrated that financially- motivated organized cyber-criminal clusters can develop and weaponize zero-day vulnerabilities at operational tempos previously associated with state-aligned cluster operations. The tradecraft pattern has substantial implications for defender threat-modeling: managed-file-transfer software, print-management software, and other business-application software with broad enterprise deployment represent meaningful mass-compromise-risk surface areas that traditional defender patch-management workflows have not adequately addressed. Second, the cluster's analytical profile differs from peer financially-motivated organized cyber-criminal clusters covered in this corpus in several ways: tradecraft pattern (mass-zero- day-exploitation vs conventional phishing-and-n-day-exploitation), operational impact scale (2,700+ victims in the MOVEit campaign alone vs hundreds-of-victims-across-multi-year-operations for most peer ransomware operations), and technical capability level (sustained zero-day-research-and-weaponization capability vs operational reliance on disclosed n-day vulnerabilities and social-engineering). The cluster represents the central reference for understanding zero-day-exploitation-as-ransomware-tradecraft. Third, the cluster's continued operations through 2024-2025 despite substantial law-enforcement pressure (June 2021 Ukrainian arrests, multiple CISA advisories, sustained international tracking) illustrate (consistent with the LockBit, Wizard Spider / Conti, and ALPHV / BlackCat patterns) that formal law-enforcement action does not necessarily produce operational pauses for sophisticated cybercriminal clusters. Fourth, the absence of named-individual-operator attribution at the Khoroshev tier represents an analytical gap. Despite the substantial operational impact of the mass-exploitation campaigns, no formal indictment of specific Cl0p administrators has been publicly issued. The gap may reflect operational considerations in ongoing investigation, may reflect difficulty in attributing specific Russia-based operators despite available evidence, or may reflect strategic choices in law-enforcement disclosure timing.

Profile

Aliases

MITRE ATT&CK aliases

Notable Campaigns

Attribution & Reporting

Operational

Techniques Used

Detection Blind Spots

Atomic Test Plan

Tools Used

CVEs Exploited