clop Ransomware

No MITRE ATT&CK MITRE ATT&CK

Ransomware catalogado como Clop (S0611)

The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.

At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware.

After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp, .Cllp, and .C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption. Depending on the variant, any of the ransom text files were created with names like 'ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.'

The Clop operation has shifted from delivering its final payload via phishing and has begun initiating attacks using vulnerabilities that resulted in the exploitation and infection of victims' infrastructures.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

• CVE-2021-35211 Crítica · 10.0 KEV SolarWinds Serv-U Remote Code Execution Vulnerability
• CVE-2021-27104 Crítica · 9.8 KEV Accellion FTA OS Command Injection Vulnerability
• CVE-2021-27103 Crítica · 9.8 KEV Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2021-27102 Alta · 7.8 KEV Accellion FTA OS Command Injection Vulnerability
• CVE-2021-27101 Crítica · 9.8 KEV Accellion FTA SQL Injection Vulnerability