Risk Letters

Threat actor

Clop

TLP:CLEAR

Facts

  • Also known as: Cl0p
  • Motivation: Financial
  • Malware and tools: Cobalt Strike, PowerShell Empire, TinyMet
  • Techniques (MITRE ATT&CK): Valid accounts, Exploit public-facing application, Phishing: Spear-phishing attachment, Command and scripting interpreter, Native API, User execution, Create or modify system process: Windows service, Boot or logon autostart execution, Exploitation for privilege escalation, Domain Policy modification: Group Policy modification, Hijack execution flow, Masquerading: invalid code signature
  • Last seen: 19 August 2026

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.