cl0p

Cl0p is a threat actor group that has emerged as the most used ransomware in March 2023, dethroning LockBit. The group has successfully exploited zero-day vulnerabilities in the past, but such attacks are relatively rare. Recent research by Malwarebytes highlights the bias of ransomware gangs for attacking English-speaking countries, and the Cl0p campaign follows the same trend. The Cl0p ransomware syndicate launched a cyberattack against several federal agencies and organizations in the US by exploiting weaknesses in MOVEit Transfer, a common file transfer platform. The group claims credit for several other cyberattacks in the past, including British Airways, Shell, and the governments in Minnesota and Illinois. The victims of the recent attack were given until Wednesday to negotiate a ransom or risk having sensitive stolen data dumped online. Many experts believe that the attacks are coming from the Cl0p Ransomware Gang, which is known to demand multimillion-dollar ransoms. The group has also been observed emailing stakeholders and customers of their victims, informing them that even their data will be leaked. Despite the successful attacks by Cl0p, the use of zero-day vulnerabilities remains relatively rare.