{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "cl0p",
    "slug": "cl0p",
    "name": "Cl0p",
    "shortName": "Cl0p",
    "country": "Multiple / Non-state",
    "countryCode": "XX",
    "sponsorship": "criminal",
    "status": "active",
    "activeSince": "2019",
    "prominence": 89,
    "tagline": "Abandoned encryption for pure data-theft extortion. Its MOVEit campaign hit 2,700+ organisations from a single vulnerability.",
    "bio": "Cl0p perfected a model that made ransomware encryption largely unnecessary: find a zero-day in a widely deployed managed file transfer product, exploit every internet-facing instance in a single automated burst, steal the data, and extort the victims.\n\nManaged file transfer products are an unusually good target. Organisations use them precisely because they move sensitive data — HR records, financial reports, health information, legal documents — and because they are often internet-facing by design, connected to many partners, and administered by teams with no security remit.\n\nThe May 2023 MOVEit Transfer campaign is the clearest example. Cl0p exploited a SQL injection zero-day across essentially every reachable MOVEit instance over a single holiday weekend. The victim count exceeded 2,700 organisations and the affected-individual count exceeded 90 million, including many organisations that had never heard of MOVEit — it was in use by their payroll processor, benefits administrator, or state agency. The group did not deploy ransomware at all in most cases; encryption would have added nothing to the leverage that possession of the data already provided.\n\nIt ran the same play against Accellion FTA in 2020, GoAnywhere MFT in early 2023, and Cleo Harmony and VLTrader in late 2024.\n\nThe group is assessed as related to the FIN11 and TA505 clusters, and operates a leak site where victims are published on a schedule if they do not pay. The U.S. State Department has offered a reward of up to $10 million for information on the actors.",
    "attribution": {
      "sponsor": "None — financially motivated criminal group",
      "service": "Assessed Russian-speaking, related to the FIN11 and TA505 clusters",
      "confidence": "high",
      "summary": "A financially motivated criminal operation with no state sponsorship, assessed as Russian-speaking based on language artifacts, infrastructure, and operational patterns. Mandiant assesses overlap with FIN11 and the broader TA505 ecosystem. Six individuals connected to the operation were arrested in Ukraine in June 2021 in a joint international action, though the group resumed activity shortly afterwards. The U.S. State Department has offered a reward of up to $10 million for identifying information.",
      "sources": [
        {
          "org": "CISA / FBI",
          "title": "CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
          "date": "2023-06-07"
        },
        {
          "org": "U.S. Department of State",
          "title": "Rewards for Justice — Reward Offer for Information on Cl0p Ransomware Actors",
          "url": "https://rewardsforjustice.net/rewards/clop-ransomware/",
          "date": "2023-06-16"
        }
      ]
    },
    "motivations": [
      "financial-gain"
    ],
    "targetSectors": [
      "Financial Services",
      "Healthcare",
      "Government",
      "Education",
      "Technology",
      "Manufacturing",
      "Legal",
      "Energy",
      "Transportation",
      "Retail & Hospitality"
    ],
    "targetCountries": [
      "United States",
      "United Kingdom",
      "Canada",
      "Germany",
      "Switzerland",
      "Australia",
      "Netherlands"
    ],
    "aliases": [
      {
        "org": "microsoft",
        "name": "Lace Tempest",
        "correlation": "exact",
        "note": "Formerly DEV-0950"
      },
      {
        "org": "crowdstrike",
        "name": "Graceful Spider",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "FIN11",
        "correlation": "partial",
        "note": "Mandiant assesses Cl0p deployment as a subset of FIN11 activity; the clusters are related but not identical"
      },
      {
        "org": "proofpoint",
        "name": "TA505",
        "correlation": "partial",
        "note": "The broader criminal ecosystem from which Cl0p emerged"
      },
      {
        "org": "secureworks",
        "name": "GOLD TAHOE",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "CL0P / TA505",
        "correlation": "exact"
      },
      {
        "org": "unit42",
        "name": "Baleful Scorpius",
        "correlation": "exact"
      },
      {
        "org": "recordedfuture",
        "name": "Cl0p",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "LEMURLOOT",
        "type": "utility",
        "custom": true,
        "description": "Bespoke ASP.NET web shell deployed to MOVEit servers, enumerating and exfiltrating stored files and Azure storage credentials.",
        "malpediaSlug": "asp.lemurloot"
      },
      {
        "name": "DEWMODE",
        "type": "utility",
        "custom": true,
        "description": "Web shell used against Accellion FTA appliances to enumerate and steal transferred files."
      },
      {
        "name": "Cl0p ransomware",
        "type": "ransomware",
        "custom": true,
        "description": "Encryption payload, increasingly optional — in the MOVEit campaign the group largely skipped encryption entirely.",
        "malpediaSlug": "win.clop"
      },
      {
        "name": "TrueBot",
        "type": "loader",
        "custom": false,
        "description": "Loader used for initial access in campaigns preceding data theft."
      },
      {
        "name": "Leak site",
        "type": "utility",
        "custom": false,
        "description": "Tor-hosted publication schedule used to escalate pressure on non-paying victims."
      }
    ],
    "techniques": [
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "note": "Zero-day exploitation of managed file transfer products at internet scale"
      },
      {
        "tCode": "T1505.003",
        "name": "Server Software Component: Web Shell",
        "tactic": "Persistence",
        "note": "LEMURLOOT and DEWMODE on file transfer appliances"
      },
      {
        "tCode": "T1213",
        "name": "Data from Information Repositories",
        "tactic": "Collection",
        "note": "Bulk theft of files staged in transfer systems"
      },
      {
        "tCode": "T1567.002",
        "name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage",
        "tactic": "Exfiltration"
      },
      {
        "tCode": "T1657",
        "name": "Financial Theft",
        "tactic": "Impact",
        "note": "Extortion based on possession of stolen data rather than availability denial"
      },
      {
        "tCode": "T1486",
        "name": "Data Encrypted for Impact",
        "tactic": "Impact",
        "note": "Increasingly optional — leverage comes from the data, not the encryption"
      },
      {
        "tCode": "T1552.001",
        "name": "Unsecured Credentials: Credentials In Files",
        "tactic": "Credential Access",
        "note": "Azure storage credentials harvested from MOVEit configuration"
      },
      {
        "tCode": "T1071.001",
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2023-34362",
        "firstExploited": "2023-05-27",
        "zeroDay": true,
        "usage": "MOVEit Transfer SQL injection exploited across essentially every reachable internet-facing instance over the U.S. Memorial Day weekend. Over 2,700 organisations and 90 million individuals affected — most of them customers of a customer, with no direct relationship to the product.",
        "source": {
          "org": "CISA / FBI",
          "title": "CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
          "date": "2023-06-07"
        }
      },
      {
        "cveId": "CVE-2023-0669",
        "firstExploited": "2023-01-18",
        "zeroDay": true,
        "usage": "Fortra GoAnywhere MFT pre-authentication command injection exploited before patch, affecting over 130 organisations.",
        "source": {
          "org": "Huntress",
          "title": "Investigating GoAnywhere MFT exploitation (CVE-2023-0669)",
          "url": "https://www.huntress.com/blog/investigating-intrusions-from-intriguing-exploits",
          "date": "2023-02-08"
        }
      },
      {
        "cveId": "CVE-2024-50623",
        "firstExploited": "2024-12-01",
        "zeroDay": true,
        "usage": "Cleo Harmony and VLTrader unrestricted file upload exploited for mass data theft from managed file transfer deployments.",
        "source": {
          "org": "Huntress",
          "title": "Cleo software actively being exploited in the wild",
          "url": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild",
          "date": "2024-12-09"
        }
      },
      {
        "cveId": "CVE-2021-27065",
        "firstExploited": "2021-03-01",
        "usage": "Exchange ProxyLogon chain exploited following public disclosure for access to enterprise networks.",
        "source": {
          "org": "Mandiant / FireEye",
          "title": "Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/detection-response-exchange-zero-days",
          "date": "2021-03-04"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "lockbit",
        "type": "operational-overlap",
        "confidence": "low",
        "note": "Both major extortion operations; distinct access methods and organisational models."
      },
      {
        "relatedActorId": "fin7",
        "type": "operational-overlap",
        "confidence": "low",
        "note": "Both long-lived Russian-speaking criminal operations that have evolved through several monetisation models."
      }
    ],
    "reports": [
      {
        "org": "CISA / FBI",
        "title": "AA23-158A: CL0P Ransomware Gang Exploits MOVEit Vulnerability",
        "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
        "date": "2023-06-07"
      },
      {
        "org": "Mandiant",
        "title": "Zero-Day Exploitation of MOVEit Transfer for Data Theft (UNC4857)",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft",
        "date": "2023-06-02"
      },
      {
        "org": "Mandiant / FireEye",
        "title": "Accellion FTA Zero-Day Exploitation and DEWMODE Web Shell",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/accellion-fta-exploit-rebrand-extortion",
        "date": "2021-02-22"
      }
    ],
    "campaigns": [
      {
        "id": "moveit",
        "actorId": "cl0p",
        "name": "MOVEit Transfer Mass Exploitation",
        "date": "2023-05-27",
        "significance": "landmark",
        "targetSectors": [
          "Financial Services",
          "Government",
          "Healthcare",
          "Education",
          "Technology",
          "Legal"
        ],
        "targetCountries": [
          "United States",
          "United Kingdom",
          "Canada",
          "Germany",
          "Switzerland"
        ],
        "cveIds": [
          "CVE-2023-34362"
        ],
        "summary": "Zero-day SQL injection exploited across essentially every internet-facing MOVEit Transfer instance over a single holiday weekend. Over 2,700 organisations and 90 million individuals affected — most of them customers of a customer, with no direct relationship to the product. Encryption was largely skipped; possession of the data was the leverage.",
        "sources": [
          {
            "org": "CISA / FBI",
            "title": "AA23-158A: CL0P Ransomware Gang Exploits MOVEit Vulnerability",
            "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
            "date": "2023-06-07"
          }
        ]
      }
    ],
    "flag": "🏴",
    "profile": "/apt/cl0p/"
  }
}