Cl0p
aka TA505, FIN11
A group that mass-exploits unknown flaws in widely used file transfer products, stealing data from hundreds of organizations at once for extortion. Known for the MOVEit and Oracle E-Business Suite campaigns.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 3
- Personal data leaked (disclosed)
- about 96.8M records
Exploited vulnerabilities and targeted products
CVE-2023-34362 CVE-2023-0669 CVE-2025-61882
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Mass-exploiting file transfer products
Like finding a flaw in a shared parcel-locker system and emptying hundreds of companies' lockers in one night.
Goal
Extortion without encryption
Like leaving the house untouched, taking only the files, and mailing the boss a demand to pay for their return.
Disclosed personal data leaks
- MOVEit 悪用の被害組織の公表合計 (Emsisoft 集計、2023年) about 95.8M records
- 米国の病院運営企業の公表 (GoAnywhere 悪用、2023年) about 962.9K records
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily