Clop is a financially motivated cybercriminal group that emerged in February 2019 as a variant of the CryptoMix ransomware, rapidly evolving into a Ransomware-as-a-Service (RaaS) operation. Initially, the group combined data encryption with exfiltration to execute double extortion campaigns, threatening to publish stolen information on their dedicated leak site if ransoms were not paid. Over time, Clop transitioned to a primarily "encryption-less" extortion model, focusing solely on large-scale data theft via exploiting zero-day vulnerabilities in Managed File Transfer solutions to maximize profits and bypass traditional endpoint defenses. The group is assessed with high confidence to be of Russian-speaking origin, with its malware designed to avoid execution on systems within Commonwealth of Independent States (CIS) countries. Clop is closely associated with the threat groups TA505 and FIN11, and has gained notoriety for its distinct strategy of conducting widespread supply chain attacks by targeting widely used enterprise software.^1,3,2

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.