FlagThis
← Threat Actors
/
Russia/Ukraine
/
Cl0p
DOSSIER // CL0P
Cl0p
▲ High Threat
Russia/Ukraine
Primary Aliases:
LACE TEMPEST
TA505
Evil Corp affiliate
🔍 Adversary Rosetta Stone (3) ▾
📋 Copy All
Sponsor / State Affiliation
Financially motivated criminal group
Primary Motivation
Financial gain (ransomware)
Active Timeline
2019 – Present
Confidence Rating
70% (Grounded)
MOVEit mass exploitation (2023) hitting 1000+ organizations, GoAnywhere zero-day
📥 Export ATT&CK Layer (.json)
🔔 RSS Feed
🏛️ CISA Advisories ↗
📋 Copy Dossier Briefing
⚔️ Weaponized CVE Matrix
(4)
CVE-2021-27101
Weaponized Vulnerability
CVSS 8.5
KEV
EPSS 85.0%
CVE-2023-2868
Barracuda ESG RCE
CVSS 9.8
KEV
EPSS 95.1%
CVE-2023-34362
MOVEit Transfer SQLi
CVSS 9.8
KEV
EPSS 96.8%
CVE-2025-61882
Weaponized Vulnerability
CVSS 8.5
KEV
EPSS 85.0%
📋 Copy CSV
Tenable Nessus
Qualys / Wiz
🎯 Target Sectors & Focus
Financial
Healthcare
Manufacturing
Technology
Education
🛡️ MITRE ATT&CK® Attack Lifecycle
(5 TTPs)
📥 Download Navigator JSON
All Stages
5
Initial Access
3
Exfiltration & Impact
1
Operational Techniques
1
Initial Access
3
T1566
MOVEit exploitation
↗
T1566
GoAnywhere exploitation
↗
T1566
Accellion FTA exploitation
↗
Exfiltration & Impact
1
T1485
Double extortion ransomware
↗
Operational Techniques
1
T1000
Mass exploitation
↗
📰 Verified Campaigns & Intelligence Archive
🔔 Subscribe to Alerts
[DEEP DIVE]
Oracle E-Business Suite: CVE-2025-61882 RCE and CL0P Ransomware Exploitation
Attacks and Vulnerabilities
2026-08-19
[DEEP DIVE]
South Staffordshire Water: A Governance Failure Exploited by Cl0p Ransomware
Attacks and Vulnerabilities
2026-05-24
Adversary Rosetta Stone // Cl0p
×
🪟 Microsoft Threat Actor Naming
LACE TEMPEST
📋
🛡️ Other Industry Tracking Codes
TA505
📋
Evil Corp affiliate
📋
Copied to clipboard
SHARE INTELLIGENCE WIRE
×
Story Title
X / Twitter
Bluesky
LinkedIn
Copy Link
LINK COPIED TO CLIPBOARD