Clop in the Spotlight: Are They Behind the New Wave of Extortion Emails?

In the evolving landscape of cyber extortion, one name has long loomed large: Clop (sometimes styled “Cl0p”). Over recent years, Clop has become one of the most notorious ransomware and data-leak extortion groups. Now, fresh intelligence suggests that a new campaign of aggressive extortion emails may be leveraging — or impersonating — Clop’s brand. But are they truly behind it?

The Clop Legacy

Clop first emerged around 2019 as a ransomware-style group, but what has distinguished its operations more recently is the heavy use of data theft, publication and extortion rather than—or in addition to—encryption.

One of Clop’s most visible operations came via the exploitation of a zero-day vulnerability in the MOVEit managed file transfer software in 2023, which yielded a large number of victims and sensitive data extractions.

Clop also has taken credit for attacks on the Cleo managed file transfer tools, in which they claimed to compromise multiple organisations, issuing extortion demands under tight deadlines.

Furthermore, Clop has periodically publicised “leak sites” (data leak sites, or DLS) where they threaten or post victim data to pressure compliance.

Their modus operandi has evolved: rather than relying solely on encryption, they increasingly focus on exfiltration, threat of publication, and reputational pressure—a model that can yield leverage even against organisations with strong backups.

Given Clop’s reputation, name recognition matters in the extortion market: to threaten under a “Clop banner” can lend implied credibility and intimidation.

The New Campaign: A Surge in Extortion Emails

In late September 2025, cybersecurity observers began seeing a flurry of high-volume extortion emails sent to executives across multiple organisations. What is striking is that these messages claim data was stolen from the recipients’ Oracle E-Business Suite systems, demanding negotiation under threat of public disclosure.

According to reporting in BleepingComputer, Mandiant (now part of Google Cloud) and the Google Threat Intelligence Group (GTIG) are actively monitoring this campaign.

Genevieve Stark, head of Cybercrime & Information Operations for GTIG, indicates the campaign began in late September.

What makes the campaign particularly intriguing is that the emails provide contact addresses which match addresses listed publicly on Clop’s own data leak (DLS) site. That overlap suggests a possible linkage—or at least an attempt to piggyback on Clop’s brand.

Yet neither Google nor Mandiant claim to have fully validated that this is authentically Clop— or that the data theft claims are legitimate. In fact, their public statements underline caution over attribution.

What Mandiant / Google Are Saying

In a direct quote provided by Mandiant’s CTO Charles Carmakal (Google Cloud), the current situation is laid out plainly:

“Mandiant and Google Threat Intelligence Group are actively tracking recent activity involving an actor claiming affiliation with the Clop extortion group.
We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts and our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion.

The malicious emails contain contact information, and we’ve verified that the two specific contact addresses provided are also publicly listed on the CLOP data leak site (DLS). This move strongly suggests there’s some association with Clop and they are leveraging the brand recognition for their current operation.

It is critical to note that while the tactics align with an extortion motive and the actor is explicitly claiming this connection, GTIG does not currently have sufficient evidence to definitively assess the veracity of these claims.

Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims.

We recommend targeted organisations investigate their environments for evidence of threat actor activity.”
— Charles Carmakal, CTO, Mandiant / Google Cloud

This is a pointed disclaimer: even while the campaign looks like Clop, it might not be Clop. The possibility that a separate actor is masquerading behind Clop’s identity cannot be ruled out.

An additional wrinkle: at least one of the compromised accounts used to send the emails has been linked with FIN11 (a known financially motivated group) in past activity. That further muddies the waters of attribution. (Carmakal’s statement above references this.)

Challenges of Attribution and Deception in Cybercrime

In cyber extortion and ransomware economies, attribution is notoriously unreliable. Threat actors often reuse names, masquerade under others, or co-opt the branding of more infamous groups to instill fear. Carmakal (in other public remarks) has emphasised this complexity:

“The majority of incidents his teams respond to are profit-motivated extortion attempts that involve not only ransomware, but data theft, victim-shaming and harassment.” Nexus

Moreover, impersonation is a known tactic. An attacker may claim “Clop” to command a higher psychological impact — even if they are simpler or lesser players underneath.

Another potential pointer: the use of previously corrupted or compromised email accounts. If an attacker has access to many legitimate mailboxes, they can send such extortion messages from credible origin addresses, thereby increasing the chance the target will take them seriously.

As Mandiant cautions, investigating whether the threat actor has deeper access in the victim environment is crucial: the emails may just be a front for intrusion or reconnaissance.

Implications and Recommendations

If the new wave of extortion emails is genuinely tied to Clop—or some actor mimicking them—it reflects a meaningful shift: extortion tactics may increasingly rely not on ransomware deployment but on mass spraying of threats, brand leverage, and social engineering pressure.

For victim organisations, here are key steps:

1. Treat every extortion claim seriously — even if you’re confident you have no data breach, attackers may bluff.

2. Trace the source: Validate the sending accounts, look for prior compromise or inbound connections.

3. Look for internal signs: Did any attacker manage to exfiltrate data, access privileged systems, or hold side channels?

4. Check your exposure: Especially in enterprise systems like Oracle E-Business Suite — have you hardened, patched, monitored access?

5. Avoid paying blindly: Paying a threat actor may not resolve it, especially if they were bluffing or merely impersonating.

6. Disclose and coordinate: Share indicators (sender addresses, email headers, domain names) with cybersecurity firms or authorities to help collective defence.

In the broader sense, we’re seeing a softening of the “ransomware only” model. Threat actors now have more levers: extortion, impersonation, psychological coercion, and brand hijacking. Whether Clop itself is behind this new campaign or is being mimicked, the message is clear: organisations must treat extortion attempts as serious, methodical threats — not just noise.

If you like, I can also prepare a technical deep dive (Tactics, Techniques, Procedures) or a timeline of Clop’s known operations to accompany this. Would you like me to do that?