ZeroFox Intelligence Flash Report - Cl0p List Latest Wave of Victims on Leak Site

ZeroFox Intelligence Flash Report - Cl0p List Latest Wave of Victims on Leak Site

Product Serial: F-2026-01-28a

TLP:CLEAR

In this Flash report, ZeroFox researchers report on the recent wave of alleged new victims listed on Cl0p's leak site.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• Ransomware and digital extortion (R&DE) collective Cl0p has claimed at least 46 victims on its victim shame site over the past week (an unusually high number in the short time period), portending an increase in operational tempo in the near term that is likely to increase their notoriety and pressure victims to pay the demanded ransoms.
• Since first observed in Q1 2022, Cl0p has had notable quarters of high-tempo activity very likely related to targeted extortion campaigns followed by several periods of relatively low activity.
• Although Cl0p has posted an extensive list of alleged victims on their leak site in the past week, they have not yet provided any details about an ongoing campaign or the type of data allegedly compromised.