Cl0p is a long-running extortion group best known for mass-exploiting vulnerabilities in managed file-transfer software to steal data from hundreds of organisations at once.

Key facts

• Pioneered large-scale, zero-day-driven campaigns against file-transfer tools including MOVEit, GoAnywhere and Accellion FTA.
• Often favours data theft and extortion over encryption, naming victims on its leak site.
• Single campaigns have affected hundreds of downstream organisations through one vulnerable vendor.
• Demonstrates the supply-chain blast radius of a single widely used product flaw.

Why it matters

Cl0p proves that one unpatched vendor vulnerability can expose thousands of organisations. Monitoring leak sites for your name and your vendors is essential for early warning.

How DarkThreatX helps

DarkThreatX monitors dark web leak sites, forums and marketplaces for activity and data tied to your organisation, so you can respond before exposure becomes a breach. Run a free dark web scan or explore the platform.