The attackers are claiming to be affiliated with the notorious Cl0p ransomware group and links have been found to FIN11.