Threat actor

Clop

ransomware93 leak-site claims, all timeLatest observed leak-site post 2026-09-10ORKL search ↗

Portable threat brief

Clop

Versioned profile fields only · no model narrative

Opens the browser print dialog; choose Save as PDF.

PDF export is unavailable. The threat brief remains available below; use your browser's Print command.

Executive facts

Actor: Clop
Kind: ransomware
Actor record created: 2026-07-31
Latest observed: 2026-09-10
Leak-site claims: 93
Catalogued techniques: 0

Scope

Tracked sectors: Manufacturing, Technology, Retail, Financial Services, Aerospace & Defense
Claim records: 2026-07-31 to 2026-09-10
Independent reporting: 2025-05-13 to 2026-09-08

Decisive signals with dates

No dated decisive signals are attached to this actor's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping in this corpus.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsManufacturingTechnologyRetailFinancial ServicesAerospace & Defense

Activity window in this corpus

This is only the tracker's observed corpus window. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2026-07-31Latest observed 2026-09-10
Independent reporting: First observed 2025-05-13Latest observed 2026-09-08

Verified ATT&CK phases represented

No verified ATT&CK mapping in this corpus

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims attributed to this actor or leak site

93 in this corpus

HENRYPRATT.COMManufacturing2026-09-10source ↗
HARLEY-DAVIDSON.COMManufacturing2026-09-10source ↗
ZEBRA.COMManufacturing2026-08-14source ↗
AOL.COMTechnology2026-08-12source ↗
GATE7LLC.COMGBBEV.COMUnclassified2026-08-12source ↗
ENTERATEK.MXESBERBEVERAGE.COMAgriculture2026-08-12source ↗
NUVITIA.COMTechnology2026-08-12source ↗
IPMSOLUTIONS.SKBusiness & Professional Services2026-08-12source ↗
ECCELLENT.COMUnclassified2026-08-12source ↗
STNET.ITTechnology2026-08-12source ↗

View all on Breaches →

Leak-site claim activity

0 additional claims without a disclosure date

2026-072026-09

Independent reporting that mentions this actor

11 in this corpus

2026-09-08vulnerabilitiesOpenAI’s tightly constrained agent probe missed an earlier warning
2026-08-19ransomwareThe long tail of Clop’s PTC hack is just beginning to emerge
2026-08-18ransomwareClop created custom web shell for Windchill data theft attacks
2026-08-18ransomwareClop Returns with Custom Implant in Mass-Extortion Campaign
2026-08-17ransomwarePhilips and GE investigating Clop ransomware data theft claims
2026-08-14ransomwareShell investigates 'potential incident' after Clop data theft claims
2026-07-24ransomwareClop ransomware targets Windchill, FlexPLM in data theft attacks
2026-07-01vulnerabilitiesResearchers spot exploitation of another critical Oracle defect
2026-05-27threat intelAgentic Attacks Have Already Hit Finance. The Defense Architecture Hasn't Caught Up.
2026-01-28threat intel7 Predictions for the 2026 Threat Landscape: Navigating the Year Ahead
2025-05-13threat intelThreat Spotlight: Capitol x Kremlin: Will US Politics Reshape Russian Cyber Threats?

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (No data licence; credited voluntarily).