Group Profile: Clop
Perfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.
Clop's Exploited Vulnerabilities
> [!NOTE]
> This is the list of vulnerabilities that have been observed during intrusions that lead to Clop ransomware deployment or data exfiltration and leaks published to Clop's Tor Site
Accellion
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Accellion File Transfer Appliance | CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 | Clop | <a href="https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion" rel="noopener" target="_blank">mandiant.com</a> |
CentreStack
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Gladinet CentreStack | CVE-2025-11371 | Clop | <a href="https://securityaffairs.com/185875/cyber-crime/clop-targets-gladinet-centrestack-servers-in-large-scale-extortion-campaign.html" rel="noopener" target="_blank">securityaffairs.com</a> |
Cleo
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Cleo VLTrader, Harmony, LexiCom | CVE-2024-55956 | Clop | <a href="https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild" rel="noopener" target="_blank">huntress.com</a> |
Fortra
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| GoAnywhere Managed File Transfer | CVE-2023-0669 | Clop | <a href="https://censys.io/rce-zero-day-in-goanywhere-mft-cve-2023-0669/" rel="noopener" target="_blank">censys.io</a> |
Oracle
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| E-Business | CVE-2025-61882 | Clop | <a href="https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/" rel="noopener" target="_blank">crowdstrike.com</a> |
Progress Software
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| MOVEit | CVE-2023-34362 | Clop | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a" rel="noopener" target="_blank">cisa.gov</a> |
PaperCut
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| PaperCut Application Server | CVE-2023-27350 & CVE-2023-27351 | Clop | <a href="https://twitter.com/MsftSecIntel/status/1651346653901725696" rel="noopener" target="_blank">twitter.com/MsftSecIntel</a> |
SolarWinds
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| SolarWinds Serv-U FTP | CVE-2021-35211 | Clop | <a href="https://research.nccgroup.com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/" rel="noopener" target="_blank">research.nccgroup.com</a> |
---
#### Sources
| Date Published | Report |
|---|
| 6 October 2025 | https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/ |
| 9 December 2024 | https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild |
| 7 June 2023 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a |
| 26 April 2023 | https://twitter.com/MsftSecIntel/status/1651346653901725696 |
| 16 Feb 2023 | https://censys.io/rce-zero-day-in-goanywhere-mft-cve-2023-0669/ |
| 8 November 2021 | https://research.nccgroup.com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/ |
| 22 Feb 2021 | https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion |
Referencias