The Clop ransomware group, a variant of the Cryptomix family, has been targeting organizations with weak security, encrypting files and appending the ‘.Clop’ extension. This cybercrime group primarily attacks big companies, aiming for financial gain.

They’ve stolen and encrypted critical files, including backups and emails, from multinational oil firms, retail giants, and healthcare providers, extorting over $500 million in ransom payments. Clop exploits AES cipher to encrypt various file types, pressuring victims to pay up before a deadline.

Since its emergence in 2019, Clop has evolved into a Ransomware-as-a-Service model, targeting global organizations, such as those hit in the Accellion FTA, GoAnywhere MFT, and MOVEit vulnerability attacks, impacting millions and costing millions in damages.