Clop Ransomware demands are typically very high, however CYPFER has had good success in bringing down initial demands to much lower final settlements. The Clop group appears to favor relatively new exploits and are know as the group that conducted numerous Accellion exploit attacks.CYPFER did not see any indiciations that the group is affiliate based, and appears to use the same communications protocols and profile across cases.The group is believed to be Ukrainian or East-European with a number of communication statements typed in Russian were observed.
https://cypfer.com/cl0p-clop-ransomware/