Cl0p Til you Drop - 6 Years, 10 Campaigns, 8 Zero-Days
Cl0p Til you Drop - 6 Years, 10 Campaigns, 8 Zero-Days
Published on: August 12, 2026
Cl0p’s defining operational characteristic is a sustained and systematic focus on managed file transfer infrastructure. Across nine known campaigns, the group has targeted:
- Accellion FTA
- SolarWinds Serv-U
- Fortra GoAnywhere MFT
- PaperCut MF/NG
- Progress MOVEit Transfer
- SysAid ITSM
- Cleo MFT (Harmony, VLTrader, LexiCom)
- Oracle E-Business Suite
- Gladinet Centrestack/TrioFox
With the partial exception of PaperCut (a print management server) and SysAid (an IT service management platform), every target shares a common architectural profile: an internet-facing application that processes, stores, or transfers files. This targeting consistency is significant for two reasons:
- It indicates strategic specialization rather than opportunistic exploitation.
- It defines a bounded, defensible attack surface.
Organizations that operate MFT infrastructure can identify themselves as potential targets and implement category-specific protections – a defensive advantage that is uncommon against most ransomware groups.
The chronological record of Cl0p campaigns reveals a distinctive operational tempo characterized by extended dormancy periods punctuated by concentrated bursts of activity. The group’s longest dormancy period – approximately 14 months between the SolarWinds Serv-U exploitation in late 2021 and the Fortra GoAnywhere campaign in January 2023 – was followed by its most active phase: four distinct campaigns across four separate technologies in ten months (January through October 2023).
When campaigns are mapped by calendar quarter, Q4 emerges as the dominant operational window. Five of nine confirmed campaigns were initiated during October through December – more than all other quarters combined. This clustering is operationally rational: Q4 coincides with major holidays in the United States and Europe (Thanksgiving, Christmas, New Year), periods when security operations centers are typically operating at reduced capacity.
For more details, check out the full article here: Read full article