{
  "slug": "clop",
  "group": "clop",
  "name": "Cl0p",
  "note": null,
  "attck": [
    {
      "id": "S0611",
      "name": "Clop",
      "kind": "malware",
      "url": "https://attack.mitre.org/software/S0611"
    }
  ],
  "activity": {
    "postings": 48,
    "first": "2026-08-12",
    "last": "2026-10-21",
    "countries": {
      "US": 23,
      "GB": 2,
      "MX": 2,
      "ES": 1,
      "SK": 1,
      "IT": 3,
      "IN": 4,
      "AU": 1,
      "HU": 1,
      "KZ": 1,
      "PE": 1,
      "CN": 1,
      "FI": 1,
      "CH": 1,
      "TW": 1,
      "IR": 1,
      "CA": 1,
      "NL": 1,
      "??": 1
    },
    "sectors": {
      "services": 3,
      "manufacturing": 7,
      "technology": 11,
      "unknown": 9,
      "agriculture": 1,
      "government": 1,
      "transportation": 1,
      "consumer": 10,
      "finance": 2,
      "education": 1,
      "healthcare": 2
    },
    "recent": [
      {
        "date": "2026-10-21",
        "name": "LEGAL-RECORDS.US",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/TEVHQUwtUkVDT1JEUy5VU0BjbG9w"
      },
      {
        "date": "2026-09-10",
        "name": "HENRYPRATT.COM",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/SEVOUllQUkFUVC5DT01AY2xvcA=="
      },
      {
        "date": "2026-09-10",
        "name": "HARLEY-DAVIDSON.COM",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w"
      },
      {
        "date": "2026-08-14",
        "name": "ZEBRA.COM",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/WkVCUkEuQ09NQGNsb3A="
      },
      {
        "date": "2026-08-12",
        "name": "AOL.COM",
        "country": "US",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/QU9MLkNPTUBjbG9w"
      },
      {
        "date": "2026-08-12",
        "name": "GATE7LLC.COMGBBEV.COM",
        "country": "GB",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/R0FURTdMTEMuQ09NR0JCRVYuQ09NQGNsb3A="
      },
      {
        "date": "2026-08-12",
        "name": "ENTERATEK.MXESBERBEVERAGE.COM",
        "country": "MX",
        "sectors": [
          "agriculture"
        ],
        "url": "https://www.ransomware.live/id/RU5URVJBVEVLLk1YRVNCRVJCRVZFUkFHRS5DT01AY2xvcA=="
      },
      {
        "date": "2026-08-12",
        "name": "NUVITIA.COM",
        "country": "ES",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/TlVWSVRJQS5DT01AY2xvcA=="
      },
      {
        "date": "2026-08-12",
        "name": "IPMSOLUTIONS.SK",
        "country": "SK",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/SVBNU09MVVRJT05TLlNLQGNsb3A="
      },
      {
        "date": "2026-08-12",
        "name": "ECCELLENT.COM",
        "country": "IT",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/RUNDRUxMRU5ULkNPTUBjbG9w"
      },
      {
        "date": "2026-08-12",
        "name": "STNET.IT",
        "country": "IT",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/U1RORVQuSVRAY2xvcA=="
      },
      {
        "date": "2026-08-12",
        "name": "QCPL.IN",
        "country": "IN",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/UUNQTC5JTkBjbG9w"
      }
    ]
  },
  "convergences": [],
  "reports": [
    {
      "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
      "publisher": "Unit 42",
      "published": "2026-10-28",
      "title": "Unwrapping Retail Peak Season Cyber Threats",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95764/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Dark Web Breach Incident Trend Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95949/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Threat Trend Report on Ransomware",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/",
      "publisher": "GuidePoint GRIT",
      "published": "2026-10-08",
      "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026",
      "publisher": "Intel 471",
      "published": "2026-09-10",
      "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan",
      "publisher": "Recorded Future Insikt",
      "published": "2026-08-25",
      "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/july-2026-cve-landscape",
      "publisher": "Recorded Future Insikt",
      "published": "2026-08-07",
      "title": "July 2026 CVE Landscape",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [
    {
      "id": "T1027.002",
      "name": "Software Packing",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 94
    },
    {
      "id": "T1057",
      "name": "Process Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactics": [
        "defense-impairment",
        "persistence"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 94,
      "related": 0
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 0
    },
    {
      "id": "T1140",
      "name": "Deobfuscate/Decode Files or Information",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 18,
      "related": 0
    },
    {
      "id": "T1218.007",
      "name": "Msiexec",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 10,
      "related": 153
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1497.003",
      "name": "Time Based Checks",
      "tactics": [
        "stealth",
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1518.001",
      "name": "Security Software Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 4
    },
    {
      "id": "T1553.002",
      "name": "Code Signing",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 4
    },
    {
      "id": "T1614.001",
      "name": "System Language Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    }
  ],
  "cves": [],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 17,
    "defendable": 17,
    "covered": 16,
    "uncovered": [
      "T1497.003"
    ]
  }
}