Security News > 2022 > May > Clop ransomware gang is back, hits 21 victims in a single month
After effectively shutting down their entire operation for several months, between November and February, the Clop ransomware is now back, according to NCC Group researchers.
This surge in activity was noticed after the ransomware group added 21 new victims to their data leak site within a single month, in April.
Clop's most targeted sector was the industrial sector, with 45% of Clop ransomware attacks hitting industrial organizations and 27% targeting tech companies.
Despite already leaking data from almost two dozen victims, the ransomware group doesn't seem very active based on the number of submissions on the ID Ransomware service.
The Clop ransomware gang's activity lull is easily explained by some of its infrastructure getting shut down in June 2021 following an international law enforcement operation codenamed Operation Cyclone coordinated by the INTERPOL. Six individuals suspected of laundering money and providing cash-out services for the Clop ransomware gang were arrested by Ukrainian authorities after 21 home searches in the Kyiv region.
While targeting victims worldwide in ransomware attacks since at least 2019, the Clop gang was also linked to a massive wave of Accellion data breaches leading to a substantial increase in average ransom payments for the first three months of 2021.