The hacking group behind the attacks on MOVEit Transfer is known as Clop. Clop group is a well-known cybercriminal gang believed to be of Russian origin. They have gained notoriety for their involvement in ransomware operations and running the Clop extortion site. They are also recognized in the industry by alternative names such as FIN11, DEV-0950, and TA505. Clop has specifically targeted organizations in North America and the UK, and they have been actively exploiting the zero-day vulnerability in MOVEit Transfer to gain control over affected systems.