Clop
Software · ATTACK:enterprise:S0611
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0611",
"title": "Clop",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0611",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--cad3ba95-8c89-4146-ab10-08daa813f9de",
"external_id": "S0611",
"domain": "enterprise",
"created": "2021-05-10T23:19:38.608Z",
"modified": "2025-04-25T14:44:41.142Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Clop"
},
{
"source_name": "Mcafee Clop Aug 2019",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
},
{
"source_name": "Cybereason Clop Dec 2020",
"url": "https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"
},
{
"source_name": "Unit42 Clop April 2021",
"url": "https://unit42.paloaltonetworks.com/clop-ransomware/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0481e814-434a-4736-80f3-f8bbcad3faf2
Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--056d19a6-8f3c-48a6-a459-69394e39fb9a
Unit42 Clop April 2021 · Mcafee Clop Aug 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0611
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d6df769-7a34-4642-85f5-bf577973456e
Unit42 Clop April 2021 · Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16632684-1ef3-41bb-9ef1-97c6c3294448
Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fb2a0f2-5d60-4b72-9d18-5d5d06d0c2fe
Unit42 Clop April 2021ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68067ea4-1d06-4c3d-bee2-2c59f43d41f4
Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a64941e-c585-4ded-b0d7-2d7f3d71eaa8
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e836d44-0047-4192-81fd-6fb8ff0cdbda
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83089e74-f35d-4b1d-9036-4e49edd82bd0
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a164dce2-be0a-487b-bbe4-185843d36c6f
Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a31e890a-074c-4452-95cb-b6cda3e9cbdd
Unit42 Clop April 2021ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5c59466-b7ac-44a0-804d-cdfbc88c8fba
Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8e128df-429d-4a98-9b34-b179272a8344
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc733ee6-f441-42b1-a201-9ff84e0f522c
Mcafee Clop Aug 2019ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7daa7ca-ca5a-4940-a370-d9eccb8f3c9a
Mcafee Clop Aug 2019 · Unit42 Clop April 2021 · Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efa0ed75-bb96-46e0-bf0b-84b6e4149542
Cybereason Clop Dec 2020ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd1836cc-0329-4501-812a-676dd234679e
Cybereason Clop Dec 2020