Loading article…
Clop (sometimes written “Cl0p”) is a cybercriminal organization known for its multilevel extortion techniques and global malware distribution. It has extorted more than $500 million in ransom payments, targeting major organizations worldwide. Clop gained notoriety in 2019 and has since conducted high-profile attacks, using large-scale phishing campaigns and sophisticated malware to infiltrate networks and demand ransom, threatening to expose data if demands are not met.
Clop increasingly uses pure extortion approaches with "encryption-less ransomware". It also employs more complex attacks, such as zero-day, that have a significant impact and allows them to demand higher ransom payments.
Clop is a Russian-speaking ransomware gang.[1] According to the US Cybersecurity and Infrastructure Security Agency (CISA), Clop is "driving global trends in criminal malware distribution".[2] Clop avoids targets in former Soviet countries and its malware can't breach a computer that operates primarily in Russian.[2]
In 2023, Clop uses more and more pure extortion approaches with "encryption-less ransomware" that skips the encryption process but still threatens to leak data if a ransom is not paid. This technique allows threat actors to achieve the same results and generate larger profits.[3]
Clop is used to conducting malicious activities during holidays, when the number of staff members present in companies tends to be at its lowest. This is the case of the Accellion FTA software attack on December 23, 2020, and MOVEit attack during the summer 2023.[4]
The cybercriminals declared to Bleeping Computer to have erased "right away" data concerning "the military, children's hospitals, GOV etc".[4]
The gang was first spotted by researchers in February 2019. It evolved as a variant of the "CryptoMix" ransomware family. Clop is an example of ransomware as a service (RaaS). Clop ransomware used a verified and digitally signed binary, which made it look like a legitimate executable file that could evade security detection.[5]
In December 2019, the group attacked Maastricht University. The ransomware encrypted almost all Windows systems used by Maastricht University, making it impossible for students and staff members to access any university online services during the Christmas break.[6] The offenders set a ransom, which allowed a decryption of the university systems after Maastricht University paid €200,000 in a Bitcoin transfer. The lessons resumed with no delays on 6 January, with most online services again available to both students and staff members.[7] In 2020, the public prosecutor service seized the cryptocurrency account in which the ransom was paid. Once the ransom was converted from Bitcoin to Euros, the university was able to recover €500,000, double of what was paid.[8]
Accellion, a company providing a legacy File Transfer Appliance (FTA), experienced a series of data breaches in mid-December 2020. Threat actors took advantage of zero-day vulnerabilities and a web shell known as DEWMODE to breach the systems of up to 100 companies using Accellion's FTA. The stolen data included sensitive files.[9]
The attacks were attributed to the Clop ransomware gang and the FIN11 threat group, although no ransomware was deployed during these specific incidents. After exfiltrating the data, the attackers threatened to make the stolen information public unless a ransom was paid. Several organizations were identified as victims of these breaches, including Kroger, Singtel, QIMR Berghofer Medical Research Institute, Reserve Bank of New Zealand, ASIC, and the Office of the Washington State Auditor, among others.[9]
In January 2023, the gang claimed responsibility for breaching over 130 organizations by exploiting a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool. This security flaw, identified as CVE-2023-0669, allows attackers to execute remote code on unpatched instances of GoAnywhere MFT that have their administrative console exposed to the Internet.[10]
In 2023, Clop employs more complex attacks that make significant impacts and allow them to demand higher ransom payments. Specifically, the Clop gang targeted data theft by exploiting a zero-day vulnerability in MOVEit Transfer. Their objective is to overcome the overall decline in ransom payments by demanding substantial amounts from their victims.[11]
2023年、このグループは 、BBCとブリティッシュ・エアウェイズ[ 1 ] 、エスティローダー社[ 12 ] 、ファースト・ソース、ファースト・ナショナル・バンカーズ・バンク（米国）、パトナム・インベストメンツ（米国）、ランダル・グリーンパークス（オランダ）、シェル（英国）[ 13 ] 、ニューヨーク市教育局[ 14 ]、アーンスト・アンド・ヤング[ 15 ]に対するハッキングの犯行声明を出した。
2023年7月現在、Clopランサムウェア集団はMOVEit Transferの脆弱性を利用した恐喝攻撃で推定7500万～1億ドルを稼ぐと予測されている。[ 11 ]
Clopは大規模なフィッシングキャンペーンを利用しています。メールにはHTML添付ファイルが含まれており、受信者をGet2というローダーをインストールするために使用されるマクロ有効ドキュメントにリダイレクトします。このローダーは、SDBOT、FlawedAmmyy、Cobalt Strikeなどの他のツールのダウンロードを容易にします。システムに侵入すると、グループは偵察、横方向の移動、およびデータ流出に進み、ランサムウェアの展開の準備を整えます。その後、Clopは交渉を試みるためにメールを送信して被害者を脅迫します。メッセージが無視されると、データ漏洩ウェブサイト「Cl0p^_-Leaks」でデータを公開すると脅迫します。[ 5 ]
Clopは最近、ネットワークへのアクセスにTrueBotマルウェアを使用していると報告されている。「Silence」ハッカーグループによって展開されたローダーは、2023年に世界中で1,500以上のシステムに影響を与えた。[ 16 ]