ColdRecon › Threat Groups › Cl0p

Threat Group Dossier

Cl0p

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Cl0p — 24 attributed incidents across our corpus.

Incidents on file24

First seen2023-01-30

Last seen2025-11-28

Top sectorGovernment

Techniques observed (MITRE ATT&CK)

T1190 Exploit Public-Facing Application (16)T1195 Supply Chain Compromise (7)T1486 Data Encrypted for Impact (1)

Sectors targeted

Government (5)technology (3)media (2)security (1)Healthcare (1)Financial Services (1)government contractor (1)Aviation (1)finance, education (1)media and aviation (1)automotive parts retail (1)Technology (1)healthcare (1)

Attributed breaches

2025-11-28

unpatched cve
multiple organizations (Michelin, Mazda, Canon, Logitech, Harvard University, etc.)

2025-11-14

unpatched cve
Entrust

2025-11-14

ransomware
Entrust

2025-11-13

unpatched cve
The Washington Post

2024-11-12

unpatched cve
Amazon, HSBC, and others

2023-12-15

supply chain
Delta Dental of California

2023-11-12

supply chain
State of Maine

2023-08-28

unpatched cve
MOVEit

2023-08-28

supply chain
M&T Bank

2023-08-14

unpatched cve
Colorado Department of Health Care Policy & Financing

2023-08-03

supply chain
Serco

2023-07-20

unpatched cve
Milliman Solutions

2023-07-18

unpatched cve
Progress Software Corporation

2023-07-04

unpatched cve
Dublin Airport

2023-06-23

unpatched cve
Gen Digital

2023-06-20

supply chain
BBC

2023-06-15

unpatched cve
multiple organizations (US banks and universities)

2023-06-14

unpatched cve
State governments of Illinois, Minnesota, and Missouri

2023-06-14

unpatched cve
Province of Nova Scotia

2023-06-06

unpatched cve
Government of Nova Scotia

2023-06-06

unpatched cve
BBC and British Airways

2023-05-31

supply chain
AutoZone

2023-05-01

supply chain
Amazon

2023-01-30

unpatched cve
NationsBenefits

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →