Indicator Watchlists

Ransomware Crews

Active ransomware / extortion groups tracked by leak-site victim volume, plus a ransomware-category catch rule.

Created 2d ago · first view

Current Hits

85
matching indicators

New Since Last View

0
by first_seen

Tracked IoCs

0

Match Rules

1

Add an Indicator

One per line. Type is auto-detected (tip_detect_ioc).

Add a Match Rule

Proactively catch future indicators by category, type, or value pattern.

Watchlist Definition (1 item)

KindDefinitionType / OpNote
RULE value ~ clop substring 40 victims

Matching Indicators

IndicatorTypeCategoryThreatSightingsLast Seen
http://metagerv65pwclop2rsfzg4jwowpavpwd6grhhlvdgsswvo6ii4akgyd.onion/ url Dark Web 1 2d ago Pivot
http://ggq4l6op3u74bclopfuvodi4ahpyj55kvjvbcffv2l7y625qjd3smkad.onion/ url Dark Web 1 2d ago Pivot
encyclopediaofbunnies-claim.pages.dev other Cryptocurrency 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/esile url Malware Families 2 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2Fsirefef url Malware Families 2 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Shipup.A url Malware Families 2 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FShipup.K url Malware Families 2 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shipup.G url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/archive/malware/pe_ghotex.a-o url Malware Families 2 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FFadok.A url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/elf_imeij.a url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_sasfis.tl url Malware Families 2 2d ago Pivot
https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx url Malware Families 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.arcrypter.a url Ransomware Actors 1 2d ago Pivot
https://www.bleepingcomputer.com/news/security/knight-ransomware-rebrands-from-cyclops-targets-windows-linux-esxi/ url Ransomware Actors 1 2d ago Pivot
https://wwwMicrosoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom%3AWin64%2FKnight.ZB!MTB url Ransomware Actors 1 2d ago Pivot
https://www.kelacyber.com/blog/cyclops-ransomware-gang-unveils-knight-raas/ url Ransomware Actors 1 2d ago Pivot
https://www.ransomlook.io/group/cyclops url Ransomware Actors 1 2d ago Pivot
https://www.trendmicro.com/vinfo/be/threat-encyclopedia/malware/ransom.win32.darkrace.thcofbd url Ransomware Actors 1 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.crylock.h url Ransomware Actors 1 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=ransom:win32/wadhrama.c&ThreatID=2147730655 url Ransomware Actors 1 2d ago Pivot
https://www.ransomlook.io/group/clop url Ransomware Actors 1 2d ago Pivot
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop url Ransomware Actors 1 2d ago Pivot
https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html url Ransomware Actors 1 2d ago Pivot
https://www.splunk.com/en_us/blog/security/clop-ransomware-detection-threat-research-release-april-2021.html url Ransomware Actors 1 2d ago Pivot
https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-c26daec604da4db6b3c93e26e6c7aa26 url Ransomware Actors 1 2d ago Pivot
https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-English-088056baf01242409a6e9f844f0c5f2e url Ransomware Actors 1 2d ago Pivot
https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/ url Ransomware Actors 1 2d ago Pivot
https://www.carbonblack.com/blog/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/ url Ransomware Actors 1 2d ago Pivot
https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/ url Ransomware Actors 1 2d ago Pivot
https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/ url Ransomware Actors 1 2d ago Pivot
https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/ url Ransomware Actors 1 2d ago Pivot
https://therecord.media/ukrainian-police-arrest-clop-ransomware-members-seize-server-infrastructure/ url Ransomware Actors 1 2d ago Pivot
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/ url Ransomware Actors 1 2d ago Pivot
https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f url Ransomware Actors 1 2d ago Pivot
https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/ url Ransomware Actors 1 2d ago Pivot
https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Clop.md url Ransomware Actors 1 2d ago Pivot
https://github.com/albertzsigovits/malware-notes/blob/master/Clop.md url Ransomware Actors 1 2d ago Pivot
https://asec.ahnlab.com/wp-content/uploads/2021/01/Analysis_ReportCLOP_Ransomware.pdf url Ransomware Actors 1 2d ago Pivot
https://unit42.paloaltonetworks.com/clop-ransomware url Ransomware Actors 1 2d ago Pivot
https://blog.malwarebytes.com/malwarebytes-news/2021/02/clop-targets-execs-ransomware-tactics-get-another-new-twist url Ransomware Actors 1 2d ago Pivot
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti url Ransomware Actors 1 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Python/CVE-2024-1709.A!dha&ThreatID=2147903327 url Threat Actors 2 2d ago Pivot
https://fortiguard.com/encyclopedia/botnet/7630456 url Threat Actors 2 2d ago Pivot
https://www.ransomware.live/group/cyclops url Ransomware Actors 2 2d ago Pivot
https://www.ransomware.live/group/clop url Ransomware Actors 2 2d ago Pivot
ClopReadMe.txt other Ransomware Actors 3 2d ago Pivot
oclopes.fr other Ransomware 1 2d ago Pivot
100clopes.com other Malware Domains 2 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ANDROIDOS_ANSERVER.A url Mobile ATT&CK 2 2d ago Pivot
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670 url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A url ATT&CK 5 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_fakeav.gzd url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918 url ATT&CK 5 2d ago Pivot
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/ url ATT&CK 5 2d ago Pivot
https://encyclopedia.kaspersky.com/glossary/man-in-the-middle-attack/ url ATT&CK 5 2d ago Pivot
https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html url ATT&CK 5 2d ago Pivot
https://www.pcmag.com/encyclopedia/term/double-extension url ATT&CK 5 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/125/how-dns-changer-trojans-direct-users-to-threats url ATT&CK 5 2d ago Pivot
https://unit42.paloaltonetworks.com/clop-ransomware/ url ATT&CK 6 2d ago Pivot
https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware url ATT&CK 5 2d ago Pivot
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/ url ATT&CK 5 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/carberp url ATT&CK 5 2d ago Pivot
https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf url ATT&CK 5 2d ago Pivot
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html url ATT&CK 6 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win64/KnuckleTouch.A!dha&threatId=-2147067254 url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Truvasys.A!dha url ATT&CK 5 2d ago Pivot
https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter url ATT&CK 6 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Coroxy.A&ThreatID=2147766831 url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/PlayCrypt.PA&ThreatID=2147830341 url ATT&CK 5 2d ago Pivot
https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel url ATT&CK 5 2d ago Pivot
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Totbrick url ATT&CK 5 2d ago Pivot
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n url ATT&CK 5 2d ago Pivot
gameclopedia.com other Scam 2 2d ago Pivot
encyclopediashow.com other Phishing 3 2d ago Pivot
encyclopaediasfggracking.info other Phishing 5 2d ago Pivot
dropprince.encyclopediashow.com other Phishing 3 2d ago Pivot
datetstop.readingencyclopedias.com other Phishing 3 2d ago Pivot
apmrtstyclopltod.com other Phishing 4 2d ago Pivot
activatedfour.encyclopediashow.com other Phishing 4 2d ago Pivot
amazonclopp21.shop other Phishing 3 2d ago Pivot

Manage Watchlist

← All Watchlists
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center