Clop Ransomware Decryption & Data Recovery

Clop (self-styled CL0P) was first identified in February 2019 and is linked to the long-running criminal groups TA505 and FIN11; Microsoft tracks related activity as Lace Tempest. CISA and the FBI published the #StopRansomware advisory AA23-158A in June 2023, estimating cumulative impact on roughly 3,000 US and 8,000 global organisations. CISA also notes the group operates simultaneously as a ransomware-as-a-service operator, an initial access broker and a large botnet operator.

What most distinguishes Clop is its operating model. It does not work victim by victim through VPN brute force or post-phishing lateral movement; it runs mass exploitation of zero-day flaws in enterprise file-transfer and business systems — one vulnerability, one campaign, hundreds or thousands of victims. Representative campaigns:

The most recent wave matters directly to large manufacturing and distribution groups. Oracle E-Business Suite is the core ERP at many such organisations, and Oracle issued an emergency patch for CVE-2025-61882 in its BI Publisher Integration component in October 2025 — but Clop had been exploiting it since August 2025 and began emailing extortion demands directly to executives at dozens of companies from late September, subsequently naming victims on its leak site. The practical consequence is that victims often learn they were breached only when the extortion email arrives — no encryption, no alert, no downtime, and the data is already gone.

Current status. Clop remains active, and works in distinct waves: quiet for stretches, then a burst whenever it acquires a new file-transfer, ERP or PLM zero-day. From mid-2026 it has been running a new PLM-focused campaign: PTC Windchill / FlexPLM CVE-2026-12569 was added to the CISA KEV catalogue on 25 June, and in August Clop named 43 victims on its leak site in a single batch, including Shell, GE and Philips. The group is therefore at a peak rather than in decline, and this wave targets engineering drawings, BOMs and similar core manufacturing data.

Identifying Clop splits into two cases, because most modern Clop incidents involve no file encryption at all.

Case one: files encrypted (less common, mostly pre-2021 or targeted attacks).

• Files gain .clop or .C_L_O_P.
• The note is ClopReadMe.txt or README_README.txt, giving an unlock@ negotiation mailbox (domain rotated per campaign) and leak-site details.
• Windows builds wrap keys with RSA; the Linux (ELF) variant carries the hardcoded RC4 master-key flaw and can be decrypted with the public tool.

Case two: pure data-theft extortion (the current norm) — no extension, no note. Identification relies on system-side artefacts:

• Web shells on file-transfer or ERP systems: LEMURLOOT in the MOVEit campaign (often disguised as human2.aspx and similar), DEWMODE in the Accellion campaign.
• Application logs showing anomalous bulk file downloads, database exports or unusually large responses.
• In Oracle EBS cases, anomalous requests against BI Publisher-related components with outbound connections.
• In PTC Windchill / FlexPLM cases, a custom JSP web shell: it references internal Windchill classes (MethodContext, WTConnection, WTKeyStoreUtil) and takes commands through the custom header X-windchill-req — grep web access logs for that header name and review the web directories for unexpected JSP files.
• A pronounced short-lived spike in egress traffic.
• Executives suddenly receiving extortion email with data samples as proof — for many victims this is the first indication anything happened.

The key judgement. If your Oracle EBS, MOVEit, GoAnywhere or Cleo systems were internet-facing before the relevant patch shipped, start an investigation on the assumption that data may already have been taken, rather than waiting for an extortion email — even with no alerts showing.

Clop's "spread" looks nothing like a conventional ransomware family: it does not aim to move laterally inside your network but to hit the data hubs you expose to the internet.

1. Zero-days in enterprise file-transfer platforms — its signature play. Accellion FTA, Fortra GoAnywhere MFT (CVE-2023-0669), Progress MOVEit Transfer (CVE-2023-34362 and related) and Cleo products were each mass-exploited in turn. These systems share a dangerous profile: internet-facing by design, carrying the most sensitive inter-company data, and often owned by a business unit rather than the security team. Planting a web shell — LEMURLOOT in the MOVEit campaign, DEWMODE in the Accellion campaign — is enough to pull databases and files straight out.

2. Zero-days in core business systems. The 2025–2026 Oracle E-Business Suite campaign (CVE-2025-61882, unauthenticated remote code execution in BI Publisher Integration, CVSS 9.8) marked Clop's extension from file transfer into the ERP itself. Oracle shipped an emergency patch on 4 October 2025, but exploitation had begun that August — meaning patching on schedule is not necessarily fast enough, and exposure reduction plus retrospective investigation must run alongside.

3. Deliberate delay. Clop typically collects data quietly at scale after obtaining a zero-day, waiting weeks or months before sending extortion emails and naming victims. That gap is exactly the window defenders most often miss.

4. Phishing and botnets. As part of the TA505 ecosystem, Clop retains conventional phishing and botnet distribution capability for the minority of cases where encryption is actually deployed.

Defence against Clop therefore centres on exposure governance rather than endpoints: inventory every internet-facing file-transfer, ERP, reporting and integration component, confirm versions and patch state, question whether public reachability is genuinely required, and build dedicated detection for anomalous bulk downloads and outbound transfers from those systems.

Any discussion of Clop's "encryption behaviour" has to start with one fact: in its major campaigns of recent years, files were often never encrypted at all.

The current norm: steal, don't encrypt. Since 2021, Clop has run pure data-theft extortion across the Accellion, GoAnywhere, MOVEit and Oracle EBS campaigns — exporting databases and files in bulk through web shells, then threatening publication. For the victim this means business systems keep running, with no encrypted extension and no ransom note; the damage is data exposure and compliance liability rather than downtime.

Where encryption does occur:

• Windows builds: file data encrypted symmetrically with the key wrapped under the attackers' RSA public key. No publicly exploitable weakness and no decryptor. Files gain .clop or .C_L_O_P and ClopReadMe.txt / README_README.txt is dropped.
• The Linux (ELF) variant (December 2022): a serious design flaw — the file's RC4 key was protected by another RC4 master key hardcoded in the sample. Symmetric protecting symmetric, so SentinelOne published a Python decryption script in February 2023. This is the only decryptable Clop branch.
• Shadow copies are typically deleted and related services stopped before encryption.

Double extortion and pressure:

• exfiltrated data published in stages on the CL0P^_- LEAKS onion site;
• extortion emails sent directly to victims' executives with data samples as proof;
• in large campaigns such as MOVEit, pressure extended to downstream customers and partners to widen the impact.

What this means for response. In a Clop incident the first question is not "can this be decrypted" but "what data left, which personal information is involved, and what are the notification obligations and deadlines" — a materially different centre of gravity from other ransomware families.