Cl0p — actor profile · ForensicPost

Actor profile· ACT-002

Files naming the group

Sectors in the corpus

Jurisdictions

2023

Earliest file

Campaign timeline14 most recent of 15

NOV 2025Logitech25-1003For most of the interval the company was the victim of an incident that had already happened and had not yet surfaced.NOV 2025Oracle EBS customers, multiple25-1110Automation, mining, peripherals, a newspaper. The vulnerability selected the victims, and the attacker learned afterwards who they were.OCT 2025Envoy Air25-1017A subsidiary carries the parent’s brand and data relationships, frequently with a fraction of its security capability.OCT 2025The Washington Post25-1016Nobody targeted a newsroom. A media organisation cannot scope its security to the systems that obviously hold journalism.OCT 2025Harvard University25-1012A university ERP holds staff, students, alumni donors and grant administration. One flaw reached all of it.OCT 2025Oracle enterprise estates25-1007The window between disclosure and exploitation is shortest exactly where the ability to respond is slowest.SEP 2025Oracle EBS deployments25-0930One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.APR 2025File-transfer estate25-0411A product that is exposed, trusted and full is not an unfortunate combination. It is the specification.APR 2025Hertz25-0403A privately held operator using the same product would have had the same exposure and, quite possibly, produced no public record at all.FEB 2025Cleo customers25-0217An organisation appears on the list because it did not pay, or paid late. An organisation absent from the list may have paid.NOV 2023Welltok23-1117An initial figure measures how far a review had got, not how large an incident was.JUL 2023Maximus23-0728The campaign is unmeasurable. Its individual victims are not.JUN 2023MOVEit Transfer customers23-0601A product bought to move sensitive files safely became the reason thousands of organisations lost them at once.JUN 2023Oregon DMV and Louisiana OMV23-0601bEvery other consumer file here involves someone who chose a company. Here the population is everyone who needed to drive.

All 15 files naming Cl0p

Attribution note

The desk applies the name where the leak site claims the victim or researchers attribute the campaign. Because the model is mass exploitation rather than targeted intrusion, a listing here says less about who was chosen than about who was running the affected product.

MITRE ATT&CK

S0611 · ClopThe ransomware, tracked as software G0092 · TA505Group ATT&CK associates with its deployment

ATT&CK has no group called Cl0p. It carries the ransomware as software and a separate group as the deployer, which is the affiliate split the corpus argues at 22-1218 — “the group attacked X” is frequently the wrong sentence.

Sectors targeted

Multiple7

Manufacturing2

Healthcare2

Logistics1

Education1

All 15 files in the database →

Defender notes

• Inventory managed file transfer products specifically; they are the recurring target class.

• Assume the window between disclosure and mass exploitation is days, not weeks.

• A victim list in this campaign is a product user list, not a target list.

ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreaches Ransomware Nation-state Cloud

DataCase files Data export Actor index Glossary Methodology

ContactSecure tips Corrections The desk Ethics