Snakefly

Snakefly is a cybercrime threat actor that runs the Cl0p ransomware and extortion operation, and is also known as TA505 and FIN11. The content describes the group as a major driver of the shift toward encryptionless extortion, increasingly relying on large-scale data theft and leak threats rather than file encryption, although Cl0p previously used its own ransomware payload, Ransom.Clop, to encrypt victim files. The group is directly linked in the content to repeated exploitation of zero-day vulnerabilities in widely used enterprise software to exfiltrate data at scale and extort victims. Reported activity includes exploitation of the MOVEit Transfer zero-day CVE-2023-34362, use of the Lemurloot web shell (also detected as JS.Malscript!g1) to steal data from underlying databases, and threats to leak stolen data unless victims paid. The content also states that Cl0p/Snakefly was linked in 2021 to exploitation of multiple Accellion FTA vulnerabilities, was responsible for exploiting the GoAnywhere MFT zero-day CVE-2023-0669 in 2023, and was linked to extortion attacks against Oracle E-Business Suite users involving CVE-2025-61882, a critical unauthenticated remote code execution vulnerability. The content characterizes Snakefly/Cl0p as pioneering zero-day exploit campaigns against enterprise software and as conducting data-theft operations that can affect hundreds of organizations through a single software flaw, creating supply-chain risk where managed file transfer or other enterprise platforms are broadly used. No nation-state attribution is stated in the provided content.