FIN11

FIN11 is a financially motivated cybercrime threat actor associated with large-scale data theft, extortion, and ransomware operations. The group is widely linked to the CL0P extortion and ransomware ecosystem and is often described as part of, or closely associated with, the broader TA505 umbrella. Reporting has also connected FIN11 to activity clusters tracked under names including UNC5936, and historical attribution around CL0P-related mass exploitation has included overlaps with clusters later merged into FIN11. The actor has been associated with Russian-speaking cybercrime and has been linked in reporting to operators connected to Russia and Ukraine, but it is not a nation-state actor. FIN11 is notable for combining opportunistic mass exploitation with enterprise-scale extortion. The group has repeatedly targeted internet-facing managed file transfer and enterprise application platforms, including MOVEit Transfer, Accellion FTA, Cleo managed file transfer products, and Oracle E-Business Suite. Multiple campaigns attributed to FIN11 or suspected FIN11 clusters involved zero-day exploitation followed by rapid data theft and extortion, often without relying primarily on file encryption. This pattern aligns with the broader shift in the CL0P ecosystem toward exfiltration-led extortion and public leak-site pressure. The actor has been tied to exploitation campaigns involving CVE-2023-34362 in MOVEit Transfer, CVE-2024-55956 in Cleo managed file transfer products, and Oracle E-Business Suite zero-day activity in 2025 involving CVE-2025-61882 and/or CVE-2025-61884. FIN11-linked operations have also been associated with extortion campaigns in which attackers used large numbers of compromised email accounts to pressure executives while claiming affiliation with CL0P. In Oracle E-Business Suite intrusions, reporting linked the activity to use of the CL0P leak site and the GOLDVEIN.JAVA downloader. FIN11 has historically monetized through several models, including point-of-sale malware, ransomware deployment, and pure extortion. The group has been associated with malware families and tooling used across financially motivated intrusion chains, including CL0P ransomware and AZORult, and has demonstrated use of web shells, downloaders, living-off-the-land techniques, and post-compromise tooling consistent with mature eCrime operations. In ransomware contexts, FIN11 activity has included process-kill logic intended to maximize operational impact prior to encryption or extortion. The group’s tradecraft emphasizes speed and scale after initial access. Observed behavior includes exploitation of public-facing applications, deployment of tailored web shells for file enumeration and theft, credential abuse, use of compromised accounts for follow-on extortion, and mass victim notification through leak-site branding. FIN11 has also been emulated in red-team exercises to demonstrate how a financially motivated actor can pivot from standard enterprise access to domain-wide compromise, critical data theft, and even access to operational technology environments. Although there is no confirmed evidence that FIN11 possesses specialized OT expertise, its tooling and process-kill behavior have raised concern that its operations could disrupt OT-dependent organizations. Known aliases and closely associated names include CL0P, Clop, TA505, Lace Tempest, DEV-0950, and UNC5936, though some of these labels may refer to overlapping clusters, branding, or broader ecosystems rather than exact one-to-one equivalence. FIN11 is best understood as a mature, profit-driven intrusion actor that has repeatedly used high-tempo exploitation and extortion campaigns against organizations across multiple sectors worldwide.