Cl0p Threat Actor Profile: File Transfer Exploitation and Defences

Cl0p steals data at scale by exploiting zero-day flaws in internet-facing file transfer and business applications, then extorting every organisation whose data it took, often without deploying ransomware at all. This profile covers the campaigns against Accellion FTA, Fortra GoAnywhere MFT, Progress MOVEit Transfer, Cleo file transfer products and Oracle E-Business Suite, as described by CISA, the FBI, Google Threat Intelligence Group (GTIG) and Mandiant, Oracle and Huntress. It is written for vulnerability management, security operations and application owners who run exposed transfer or ERP platforms. Attribution follows each source's own wording, and the page deliberately avoids leak-site content and victim lists.

Key takeaways

• The pattern is mass exploitation, not targeted intrusion. Each campaign used one flaw in one widely deployed product to reach many organisations in days, which CISA's MOVEit advisory describes as the group's shift towards data theft over encryption from 2021.
• File transfer and ERP servers are the target class. Four of the five campaigns hit managed file transfer (MFT) products; the 2025 campaign hit Oracle E-Business Suite. All five CVEs are in the CISA Known Exploited Vulnerabilities (KEV) catalogue with known ransomware use.
• Application accounts are the foothold. The MOVEit web shell created rogue administrator accounts named "Health Check Service", and Oracle EBS post-exploitation ran as the applmgr service account.
• Patching alone is not remediation. CISA warns that rebuilding a MOVEit web server while keeping the database can retain the attacker's accounts, and GTIG found Oracle EBS implants that live in memory and in database tables.
• Exposure reduction and egress control blunt the model. Keeping transfer and ERP interfaces off the open internet, blocking outbound connections from those servers and hunting quickly after disclosure address most of the documented behaviour.

Who they are (names and aliases)

"Cl0p" (also written Clop or CL0P) is first a ransomware family and an extortion brand, and only loosely a single group. MITRE ATT&CK tracks the ransomware as software S0611, first observed in February 2019 and described as a variant of CryptoMix. MITRE links it to the criminal group TA505 (G0092), which it says has been active since at least 2014 and runs ransomware campaigns involving Clop. Vendors warn that the brand is not exclusive to one cluster, so record which source each name comes from.

See the Threat Actor Groups Guide for how vendor naming conventions differ, and the Ransomware Groups Guide for how Cl0p compares with affiliate-driven operations.

Targeting and motivation

• Motivation: financial, through extortion. CISA describes double extortion (theft plus encryption, with threatened publication) and a move towards data exfiltration without encryption from 2021 onwards.
• Selection by product, not by sector: victims are whoever ran the vulnerable product on the internet at the time. MITRE lists Clop victims across retail, transport and logistics, education, manufacturing, energy, finance, healthcare, telecommunications, professional services and high tech.
• Scale: CISA states that TA505 is estimated to have compromised more than 3,000 US organisations and 8,000 organisations globally. For GoAnywhere, CISA records that the group claimed about 130 victims over 10 days.
• Executive pressure: in the Oracle EBS campaign GTIG describes high-volume extortion emails sent to company executives, with file listings as proof and payment terms withheld until contact.
• Delayed publication: GTIG notes the brand has historically waited several weeks before posting data, which gives defenders a window between exploitation and public pressure.

Tactics and techniques (MITRE ATT&CK)

All IDs below are ATT&CK v20 entries verified against MITRE's dataset. Some come from MITRE's S0611 and G0092 entries; others are our mapping of behaviour described in the cited advisories. CISA's AA23-158A used ATT&CK v13, so some of its defence evasion IDs have since moved; the table uses current IDs.

How they abuse identities and credentials

Application and service accounts

• Rogue administrators inside the product: CISA describes LEMURLOOT creating MOVEit user accounts and provides an audit query for active administrators (Permission=30, Status active, not deleted). Accounts created inside an application bypass directory controls entirely, so they need their own review. See the Managed File Transfer (MFT) Security Guide.
• Header-based authentication to the web shell: LEMURLOOT authenticated requests with the X-siLock-Comment HTTP header, a shared secret rather than any identity, which is why log review for that header is a useful hunt.
• Service account inheritance: on Oracle EBS, code execution ran as the applmgr operating system account. Whatever that account can read, reach and run, the attacker can too. See the Service Account Security Guide.

Cloud secrets and borrowed mailboxes

• Cloud storage credentials: CISA states the MOVEit web shell could retrieve Azure settings and Blob Storage details. Any storage keys or connection strings configured in the transfer platform should be treated as exposed after compromise and rotated.
• Infostealer-sourced mailboxes: GTIG assesses the 2025 extortion emails came from hundreds or thousands of compromised third-party accounts, likely with credentials from infostealer logs, which lends legitimacy and helps evade spam filters. See the Infostealer Threat Guide.

Notable incidents

The table describes campaigns, not individual victims. Attribution is shown as each source publishes it.

The Oracle EBS case is the clearest illustration of the identity angle: no stolen password was needed to get in, but the attacker then operated as the application's service account and extorted through other organisations' compromised mailboxes. See the Oracle E-Business Suite and Fusion Security Guide.

Detection and defence

Detection signals

Defences in priority order

1. Inventory exposure: list every MFT, B2B gateway and ERP interface reachable from the internet, with version and owner. KEV entries for this product class should trigger an out-of-band patch cycle. See the Attack Surface Management Guide.
2. Reduce exposure: put administrative and non-partner interfaces behind VPN or an access proxy. Huntress advised moving exposed Cleo systems behind a firewall until a fix existed, and Oracle advises keeping EBS on supported versions with all Security Alerts applied.
3. Restrict egress: GTIG recommends blocking non-essential outbound traffic from EBS servers so that callbacks and exfiltration fail even after compromise. Apply the same default-deny rule to transfer servers.
4. Disable risky features: clear the Cleo "Autorun Directory" setting where it is not needed (Huntress notes this does not fix the file-write flaw itself).
5. Hunt after every patch: treat a patched server as possibly compromised until you have checked web roots, application accounts, database tables and memory. CISA warns rebuilt MOVEit servers can keep attacker accounts if the database is retained.
6. Rotate what the platform holds: service account passwords, cloud storage keys and partner credentials configured in the application.
7. Prepare for extortion without encryption: an incident plan that covers data-theft-only cases, legal notification and executive email handling. See the Ransomware Response and Recovery Guide.

Metrics

• Exposure count: internet-reachable MFT and ERP admin interfaces (target zero).
• KEV time to patch: hours from KEV listing to patch or isolation for exposed systems.
• Egress coverage: share of transfer and ERP servers under default-deny outbound rules.
• Application account review: share of admin accounts inside MFT and ERP products reviewed in the last 90 days.
• Post-patch hunt completion: share of emergency patches followed by a documented compromise check.

Framework mapping

This mapping is our own alignment of the defences above to control IDs, not a mapping published by CISA or NIST.

Common failure patterns

• Patch and walk away: applying the fix without hunting. Web shells, rogue accounts and in-memory implants survive the patch.
• Rebuild with the old database: CISA notes a rebuilt MOVEit server with an intact database can keep the attacker's accounts.
• Trusting the first fix: Cleo's October 2024 patch for CVE-2024-50623 did not stop the December exploitation, which led to CVE-2024-55956. Track vendor advisories until researchers confirm the fix holds.
• Unrestricted outbound access: application servers that can reach any internet address make second-stage downloads and exfiltration trivial.
• Overprivileged service accounts: an application account that can read far beyond its own data turns one flaw into a wide breach, as the Oracle E-Business Suite Exploitation 2025 showed with applmgr.

Practitioner checklist

• Maintain an inventory of internet-facing MFT, B2B and ERP systems with owner, version and exposure.
• Subscribe to vendor advisories and the CISA KEV feed for those products, with an agreed emergency patch time.
• Move administrative interfaces off the public internet and restrict partner access by allowlist.
• Enforce default-deny outbound rules on transfer and ERP servers.
• Review accounts created inside MFT and ERP applications at least quarterly and after every relevant advisory.
• After any emergency patch, hunt web roots, application accounts, the database tables named by vendors and Java process memory.
• Rotate service account passwords and cloud storage keys held by a compromised platform.
• Alert on shells spawned by Java, IIS or javaw processes on these servers.
• Rehearse a data-theft-only extortion scenario with legal, communications and executives.

Standards and references

• CISA and FBI: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)
• Oracle: Security Alert Advisory CVE-2025-61882
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: Clop (S0611)
• MITRE ATT&CK: TA505 (G0092)
• Google Threat Intelligence Group: Oracle E-Business Suite Zero-Day Exploitation and Extortion Campaign
• Huntress: Cleo Software Actively Being Exploited in the Wild
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Qilin Threat Actor Profile · Web Shell Response Playbook · Patch Management Guide · Ransomware Prevention Guide