threat actor · Origin not attributed
Clop
3 CVEs exploited (2 in CISA KEV)
1 article this week: PTC patches Windchill and FlexPLM flaw enabling remote code execution
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open Clop's actor pageInfosecurity described Clop as a ransomware group active since 2019, while SOCRadar also called it Cl0p. DataBreaches.net described Clop as Russian-speaking and reported exploitation of software vulnerabilities for ransom.
Source: CyberSIXT profile, 26 October 2026. The opening of CyberSIXT's sourced profile of this actor; the profile cites its sources.
- Also known as
- Cl0p
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.