Clop

Profile

Clop is a financially motivated ransomware group active since 2019, known for combining system encryption with large-scale data theft and follow-up extortion. Its most distinctive trait is the exploitation of vulnerabilities in managed file transfer platforms: in 2023 it compromised numerous large organisations through flaws in MOVEit Transfer and MOVEit Cloud. Its victims span sectors such as education and healthcare, with a notable concentration in the United States. Recent incidents include the December 2025 attack on the University of Phoenix, which affected nearly 3.5 million people.

Active since: 2019

Initial access

• Exploitation of vulnerabilities in managed file transfer platforms (MOVEit Transfer and MOVEit Cloud)

Tools

Clop ransomware (system encryption and data-leak extortion)

What defenders should watch

• Prioritise inventory, internet exposure review and prompt patching of file transfer platforms (MOVEit Transfer/Cloud and equivalents), historically the group's preferred vector.
• Monitor abnormal data egress volumes from file transfer servers to external destinations: the main impact is usually data theft rather than encryption alone.
• Education and healthcare organisations, particularly in the United States, are among the observed targets and should review incident response and personal data breach notification plans.
• For incidents involving mass exfiltration (such as the December 2025 case affecting 3.5 million people), having pre-agreed communication procedures for affected individuals and regulators significantly reduces impact.

Recent victims

Sources analysed

• ShinyHunters Claim Hack of Rival Ransomware Gang Clop (Infosecurity Magazine, 9/21/2026)