Clop

Clop made headlines in 2021 for their tactic of culling through victims’ stolen data and retrieving contact information for the company’s customers and partners, then emailing them urging them to make the victim company pay the ransom.

攻撃者たちは悪用可能な脆弱性の情報を調べ、素早く攻撃に組み込みます。

L’objectif des attaquants est d’acquérir des droits d’administration réseau afin de faciliter le déploiement du code de chiffrement sur l’ensemble du système d’information à partir de serveurs centraux.

“Threat actors know to take advantage of weaknesses, like outdated software and legacy systems, to gain access” and CL0P “shifted its focus to exploiting vulnerabilities in third-party software.”

The syndicate previously executed zero-day supply chain attacks against managed file transfer platforms, including MOVEit Transfer and Accellion FTA, compromising hundreds of organizations worldwide.

Ces attaques semblent être le résultat d’une vaste campagne d’hameçonnage ayant eu lieu autour du 16 octobre 2019 et liée au groupe cybercriminel TA505.

Malicious spam emails with spear-phishing links or attachments

Once sufficient data had been collected, the attackers created scheduled tasks on a large number of systems to simultaneously start executing the Clop ransomware

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Once sufficient data had been collected, the attackers created scheduled tasks on a large number of systems to simultaneously start executing the Clop ransomware

L’objectif des attaquants est d’acquérir des droits d’administration réseau afin de faciliter le déploiement du code de chiffrement sur l’ensemble du système d’information à partir de serveurs centraux.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Once sufficient data had been collected, the attackers created scheduled tasks on a large number of systems to simultaneously start executing the Clop ransomware

L’objectif des attaquants est d’acquérir des droits d’administration réseau afin de faciliter le déploiement du code de chiffrement sur l’ensemble du système d’information à partir de serveurs centraux.

le rançongiciel est souvent déployé en début ou veille de week-end et comporte une fonction de suppression des copies cachés Windows (Volume Shadow copies).

Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed

L’objectif des attaquants est d’acquérir des droits d’administration réseau afin de faciliter le déploiement du code de chiffrement sur l’ensemble du système d’information à partir de serveurs centraux.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Afin de s’assurer que la machine sur lequel il se trouve n’a pas déjà été chiffrée, le rançongiciel Clop vérifie la présence d’un « mutex » sur celle-ci et ne s’exécutera pas s’il est présent.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

des certificats sont utilisés pour signer le code malveillant Clop afin de lui donner une apparence légitime.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Afin de s’assurer que la machine sur lequel il se trouve n’a pas déjà été chiffrée, le rançongiciel Clop vérifie la présence d’un « mutex » sur celle-ci et ne s’exécutera pas s’il est présent.

Ahnlab et le CERT gouvernemental sud-coréen rapportent l’usage de la porte dérobée FlawedAmmyy (parfois renommée wsus.exe) et de l’outil d’attaque Cobalt Strike lors de cette phase.

Threat actors exfiltrate structured databases and unencrypted files using custom web shells, demanding multi-million-dollar ransoms in exchange for non-publication.

The group sifts through a manager's files and emails, and exfiltrates data that they think might be useful in threatening, embarrassing, or putting pressure on a company's management

“gegevens stelen” en in het voorbeeld: “10GB data naar server in Finland.”

This is why, in recent intrusions, a group that has often used the Clop ransomware strain has been specifically searching for workstations inside a breached company that are used by its top managers. The group sifts through a manager's files and emails, and exfiltrates data that they think might be useful in threatening, embarrassing, or putting pressure on a company's management

Terabytes of documents and files stolen from victim organizations that have not paid a data ransom are now available for download from CLOP’s deep web site

The extortion collective listed Shell on its dark web leak portal, alleging the theft of approximately 89 gigabytes of proprietary corporate data.

Ransomware threats “aim[] to lock down critical data and disrupt operations for financial gain”; LockBit is noted for “speed and efficiency in encrypting systems.”

...but they go to great lengths to extort ransom payments from their victims by notifying the victim company’s customers, partners and employees of the breach and by publishing sensitive data of the victim company’s employees...