// THREAT ACTOR
CLOP_
ActiveCl0p is a long-running ransomware operation associated with the FIN11 / TA505 threat cluster. It is best known for its mass exploitation of file-transfer software vulnerabilities — including Accellion FTA, GoAnywhere MFT, and MOVEit Transfer in 2023 — to compromise hundreds of organisations in single campaigns.
For Ransomnews editorial coverage of CLOP — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
2,313
Victims tracked
2 / 11
Active mirrors
2021-09-09
First listing
2026-08-13
Most recent
Victims by year
- 2026 221
- 2025 549
- 2024 28
- 2023 399
- 2022 577
- 2021 539
Leak site mirrors
11 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
ekbgzchl6x2ias37.onionHOME | CL0P^_- LEAKS snapshot · 2022-08-19 02:13 -
santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onionDDOS Protection snapshot · 2026-08-14 22:32 -
3ws3t4uo7fehnn4qpmadk3zjrxta5xlt3gsc5mx4sztrsy7ficuz5ayd.onionsnapshot · 2024-12-15 13:29 -
amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onionsnapshot · 2024-12-15 13:00 -
qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion403 Forbidden snapshot · 2024-12-15 13:15 -
npkoxkuygikbkpuf5yxte66um727wmdo2jtpg2djhb2e224i4r25v7ad.onion404 Not Found snapshot · 2025-01-22 11:15 -
6v4q5w7di74grj2vtmikzgx2tnq5eagyg2cubpcnqrvvee2ijpmprzqd.onionsnapshot · 2025-01-22 12:03 -
l4rdimrqyonulqjttebry4t6wuzgjv5m62rnpjho3q22a6maf6d5evyd.onion403 Forbidden snapshot · 2025-11-09 04:03 -
frgp3f3u2ddafv4ny7tqn6tc674m6fyymyywoaxot7xskbjmiyhhsyqd.onionsnapshot · 2026-02-20 12:24 -
htmxyptur5wfjrd7uvg23snupub2pbtlfelk45n37b3augl2w4eearid.onionsnapshot · 2026-08-14 22:30 -
2vi357dgf4246nvrcsavrt5jsrm7pfqim4t2n3ykzedjim5bzqezmlyd.onion403 Forbidden snapshot · 2025-10-09 10:02
Recent victims
The 50 most recent victims claimed by CLOP. Total in the index: 2,313.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-13 | ZEBRA.COM | Data exfiltrated included the following: Database, Project - files, CA… |
| 2026-08-12 | NETPOWER.COM | Data exfiltrated included the following: Projects, Cad-files, Backup f… |
| 2026-08-12 | SHELL.COM (August 2026) | Data exfiltrated included the following: Engineering drawings, photos … |
| 2026-08-12 | GE.COM | Data exfiltrated included the following: Software backups, system file… |
| 2026-08-12 | FISERV.COM | Data exfiltrated included the following: Projects, Cad-files, files Wi… |
| 2026-08-12 | PHILIPS.COM | Data exfiltrated included the following: PDF drawings, diagrams, bluep… |
| 2026-08-12 | ALDOGROUP.COM (ALDOSHOES.COM) | Data exfiltrated included the following: TSV files, soft, Projects, Ca… |
| 2026-08-12 | IRCO.COM | Data exfiltrated included the following: Cad-files, PDF drawings, diag… |
| 2026-08-12 | TOASTTAB.COM | Data exfiltrated included the following: project, backup database, log… |
| 2026-08-12 | LARGAN.COM.TW | Data exfiltrated included the following: Project, Soft Total size: 56… |
| 2026-08-12 | STARKEY.COM | Data exfiltrated included the following: Database, Project Total size… |
| 2026-08-12 | PARTECH.COM | Data exfiltrated included the following: Database, Project, Cad-files,… |
| 2026-08-12 | MAMMUT.COM | Data exfiltrated included the following: .png files, files Windchil T… |
| 2026-08-12 | CORNELIUS.COM | Data exfiltrated included the following: Database, Project, PDF, TXT, … |
| 2026-08-12 | MAMASANDPAPAS.COM | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | TRISTAR.COM | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | SMAPCENTER.UAH.EDU | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | SUUNTO.CN (SUUNTO.COM) | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | BRILLONCONSUMER.COM (BRILLONCONSUMER.COM) | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | JPMGROUP.CO.IN | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | CLOVER.COM | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | ATOMBERG.COM | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | HONGHE-TECH.COM | Data exfiltrated included the following: Database, Project - files To… |
| 2026-08-12 | INTELLIGENTGROWTHSOLUTIONS.COM | Data exfiltrated included the following: Database, Project, PDF, XLSX,… |
| 2026-08-12 | INTELLIHOT.COM | Data exfiltrated included the following: Database, Projects, Backups, … |
| 2026-08-12 | 9ALTITUDES.COM | Data exfiltrated included the following: Database, Projects, Project B… |
| 2026-08-12 | WATERLANDPE.COM | Data exfiltrated included the following: Database, Projects, Project B… |
| 2026-08-12 | THERMOS.COM | Data exfiltrated included the following: Database, Projects, Soft inst… |
| 2026-08-12 | NUOVACMM.COM | Data exfiltrated included the following: Database, Projects, Soft inst… |
| 2026-08-12 | IVALUESYS.COM | Data exfiltrated included the following: Database, Projects, Backups … |
| 2026-08-12 | SPKAA.COM | Data exfiltrated included the following: Database, Projects Total siz… |
| 2026-08-12 | LIFESTRAW.COM | Data exfiltrated included the following: Database, Projects, Backups, … |
| 2026-08-12 | OMNITANKER.COM | Data exfiltrated included the following: Database, Projects, SQL Backu… |
| 2026-08-12 | ARCHERGREY.COM | Data exfiltrated included the following: Database, Projects Total siz… |
| 2026-08-12 | G3AEROSPACE.COM | Data exfiltrated included the following: Database, Projects Total siz… |
| 2026-08-12 | ITKHOLDING.HU | Data exfiltrated included the following: Database, Projects Total siz… |
| 2026-08-12 | MIDLANDIND.COM.AU | Data exfiltrated included the following: Database, Project Total size… |
| 2026-08-12 | FLUIDLOGIC.COM | Data exfiltrated included the following: Database, Project,Cad-files … |
| 2026-08-12 | QCPL.IN | Data exfiltrated included the following: Database, Project Total size… |
| 2026-08-12 | STNET.IT | Data exfiltrated included the following: Database, Project Total size… |
| 2026-08-12 | ECCELLENT.COM | Data exfiltrated included the following: DBF files, Cad-files, Project… |
| 2026-08-12 | IPMSOLUTIONS.SK | Data exfiltrated included the following: PDF files, Cad-files, Soft T… |
| 2026-08-12 | NUVITIA.COM | Data exfiltrated included the following: Project, Soft Total size: 89… |
| 2026-08-07 | CONTINENTAL.AERO | |
| 2026-08-07 | MINDRAY.COM | |
| 2026-08-05 | nuv******* | Data exfiltrated included the following: Project, Soft Total size: 89… |
| 2026-08-05 | ipm******* | Data exfiltrated included the following: PDF files, Cad-files, Soft T… |
| 2026-08-05 | ecc******* | Data exfiltrated included the following: DBF files, Cad-files, Project… |
| 2026-08-05 | st******* | Data exfiltrated included the following: Database, Project Total size… |
| 2026-08-05 | qc******* | Data exfiltrated included the following: Database, Project Total size… |