Clop
- ID
- S0611
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
Clop is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace, telecommunications, professional and legal services, healthcare, and high tech industries. Clop is a variant of the CryptoMix ransomware.[1][2][3]
Techniques used (17)
- T1027.002 Software Packing
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1083 File and Directory Discovery
- T1106 Native API
- T1112 Modify Registry
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 Msiexec
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1497.003 Time Based Checks
- T1518.001 Security Software Discovery
- T1553.002 Code Signing
- T1614.001 System Language Discovery
- T1685 Disable or Modify Tools