Cl0p doesn’t pick a sector. It picks your software.

More than 2,700 organizations were hit in the 2023 MOVEit campaign, and 84% of them never ran MOVEit. According to Cybersecurity Dive’s analysis of Emsisoft and KonBriefing data, they were reached through a third party: a service provider, an accounting firm, or a subcontractor’s subcontractor that did.

That one number explains Cl0p better than any actor profile. It also explains why “is my industry being targeted?” is the wrong question. The useful one is: do we run that kind of software, or do we rely on someone who does?

In our latest Threat Signal session, Chouchane Chekherdemian, Cyber Threat Intelligence analyst at Citalid, walked through ten campaigns linked to Cl0p, from Accellion in late 2020 to Windchill this summer. Her findings fit into three words: exposure, silence and proof.

Six years, one playbook

Cl0p started in 2019 as ransomware that locked a company’s files until it paid. In 2020 it added a data leak site to name the victims who refused. Since around 2021, its big campaigns don’t lock anything at all. They steal data in bulk, then charge the company to keep quiet about it.

In Citalid’s classification, Cl0p is an affiliate-type criminal intrusion set: a structured, profit-driven criminal organization with significant operational capability. Chouchane is careful with the name, though. Security vendors track related clusters under their own labels, such as FIN11 at Google, and those labels overlap without being identical. “When we say Cl0p, we mean a brand and a way of operating, not necessarily one fixed team behind every campaign.”

The way of operating barely changes. Cl0p finds one flaw in one product that lots of organizations expose to the internet, then goes after all of them at once. File transfer tools came first, from Accellion to MOVEit in 2023 and Cleo at the end of 2024. Then came an ERP, Oracle E-Business Suite, in 2025, and this summer the platform manufacturers use to store their engineering data, PTC Windchill.

What has changed is the pace. For years Cl0p worked in bursts, with pauses of a year or more. Since late 2024, a new campaign has landed every three to eight months. Five of the ten campaigns we reviewed started between October and December, and the group likes US holiday weekends, when teams are thin: Memorial Day for MOVEit, Thanksgiving for a file sharing campaign in late 2025. “It’s a small sample,” Chouchane notes, “so we read it as a pattern to plan around, not a calendar to rely on.”

Exposure: your applications, and your suppliers’

An exposed application is one that anyone, anywhere, can reach just by typing its address, without first being inside your network. There is usually a good reason for it: customers, suppliers and subcontractors need to log in. “Picture a door that opens straight onto the street, rather than one inside the building, behind reception,” Chouchane says.

Cl0p goes for a very specific kind of street door: a business application that outsiders have to use and that already holds a lot of data. Once through it, the application does most of the work. It already gathers the files and can already read them, so there is no need to wander around the rest of the network.

The Windchill campaign this summer is a case in point. In late July, the same extortion email landed on hundreds of desks in each targeted company at once, claiming a Windchill data leak. PTC had shipped a fix on June 17, but Ransom-ISAC assesses that exploitation began in early June, before that fix existed. Fewer than 100 Windchill servers were exposed to the internet on June 1, according to Censys. A small target, but behind those servers sat designs and parts lists, data you cannot reset like a password. What the case doesn’t show is who was at the keyboard: the emails carry Cl0p’s name, but researchers who studied the intrusions call the link likely, not confirmed.

This is where the MOVEit number matters. The software decides who gets hit far more than industry or size, and your exposure includes your suppliers’. A third party risk program built on annual questionnaires struggles to capture that, because the risk depends on what your vendors expose at any given moment.

The first action is easy to state. Ask your application owners for one list: every business application open to the internet that holds files or business data, with an owner on every line. Then add the column people forget, the same question for your critical suppliers. For each line, ask whether it really needs to face the internet. If it does, open only what is needed behind a web application firewall, and treat every blocked request as an alert.

Silence: seven weeks with nothing to see

Most people picture ransomware as black screens and stalled production. Cl0p is the opposite. Nothing breaks, the business keeps running, nobody calls the help desk. Then one day an email arrives: we have your files, pay us or we publish them. What you would be paying for is a promise of silence from criminals, one you can never verify. And paying or not, you may still have to notify customers, partners and regulators. “The real cost is about trust, much more than downtime,” Chouchane says.

Encrypting files on the server doesn’t help much either. Cl0p takes over the application, and the application can read its own files. “It’s a safe with the key taped to the front door.” The quickest win is to clear out whatever no longer needs to sit on those servers, because what isn’t there can’t be stolen.

The 2025 Oracle E-Business Suite campaign is the case where the silence was total. Google Threat Intelligence Group and Mandiant traced suspicious activity back to July 10 and exploitation back to August 9, through a flaw Oracle didn’t yet know about. For about seven weeks, data left with no advisory, no article and no patch to start anyone’s clock. From September 29, executives at dozens of companies received extortion emails from hijacked accounts, some with real file listings from their own systems. Oracle’s emergency fix for CVE-2025-61882 came out a few days later. Even the fastest patching in the world would not have prevented the theft. As for who was behind it, Google sees the hallmarks usually tied to Cl0p’s campaigns but stops short of a formal attribution.

Oracle is not an outlier. In most of the ten campaigns, the flaw was exploited before anyone knew it existed, and Cl0p tends to go public within a week or two of the announcement, as its window closes. The practical consequence is simple: when a flaw in one of your exposed applications is announced as exploited, assume the clock started before the announcement.

Two habits follow. First, learn what normal outbound traffic looks like for each server on your list, so that a server suddenly sending far more than usual, somewhere new, at three in the morning, gets noticed. Second, turn every announced flaw into a countdown: patch the same day and, in the same ticket, search back for signs that someone got in first. “A patch closes the door for the future. It doesn’t tell you who’s already come in.”

Proof: what you will need to show when the email lands

With Cl0p, the extortion email is where your costs start, and three answers largely decide how big they get: is it real, since when, and what left?

Is it real? Not always. Fraudsters have sent fake Cl0p emails with no stolen data behind them, so no email and no leak site listing should be taken at face value. Since when? That is where your records come in. What left? That is the answer everything else hangs on: who you notify, what you tell regulators and partners, and what you say if someone asks you to pay.

MOVEit shows, with hindsight, what kept logs can do. Kroll found activity consistent with the exploit in its clients’ server logs as early as April 2022, and in some cases July 2021, long before the May 2023 attack. Our own review of published data points the same way: the addresses Cl0p used against another file transfer tool in early 2023 had already been scanning MOVEit servers the year before. A company that searched its MOVEit logs for those addresses when they were published would have seen someone probing its server about three months before the attack. As long as it still had the logs. “The information was public. The records just weren’t there anymore.”

Two actions follow. Check how long you keep the access logs of the applications on your list, with a year as a sensible minimum, agreed with your legal and privacy teams since logs hold personal data too. Then write the extortion procedure now, not on the day: one channel for any email that claims a theft, nobody replies or forwards it, someone checks the claim against your own logs, and a sanctions check happens before anyone mentions payment. With Cl0p, the email lands on a lot of desks at once.

ShinyHunters, and what it means for the next campaign

In September, Cl0p got hacked itself. The rival intrusion set ShinyHunters took over the server behind its leak site through a flaw in Grav, the off the shelf software running it. Cl0p admitted to BleepingComputer that its installation wasn’t fully up to date, then moved the site to a new address. The irony was hard to miss: the group that makes its living off unpatched software got caught out by unpatched software.

It is worth separating what is confirmed from what is only claimed. ShinyHunters says it took the site’s code, its logs, the keys to its old address and a list of the companies that paid Cl0p in the Oracle campaign, and it is demanding an eight figure payment. At the time of our session, it had shown no proof and published no list. If your organization paid Cl0p in the past, the advice is still to be ready: brief your legal and communications teams now, and make sure the records of that payment are kept and easy to find.

Does any of this change the outlook? “It doesn’t change the method, but it may change the name on it,” Chouchane says. The brand has taken a public hit, and extortion only works if victims believe a payment buys silence. Even so, Citalid assesses that another campaign of this kind, by Cl0p or by someone using its playbook, is likely before the end of March, with the end of the year as the period to watch most closely. “I’d treat the calendar as a staffing decision rather than a forecast: someone on call who can patch and search the logs of your exposed applications over Thanksgiving and the year end break.”