Clop Ransomware
Clop is a ransomware tool which encrypts files and is used, with a data leak site, to aid in double-extortion attempts.
Summary
Clop is a ransomware tool which encrypts files and is used, with a data leak site, to aid in double-extortion attempts.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in February 2019, Clop is a variant of the older CryptoMix ransomware. It has been used as the final payload in double extortion attacks, where data has been extracted before compromised systems are encrypted. This data is then published to a specific leak site Clop has used since March 2020. Clop has affected organisations across a range of sectors, including healthcare, and has been observed in attacks in the USA, Europe, Canada, Asia Pacific, and Latin America.
Delivery
Clop was originally delivered through spam email campaigns, but recent delivery methods include spear phishing or via exploitation of exposed or vulnerable systems.
TA505, one of the most notable groups to deploy Clop, use phishing emails containing macro-laden attachments as delivery vectors. When opened, these macros drop a variant of the Get2 downloader, which in turn downloads and installs the SDBot remote access trojan. SDBot is then used to explore the affected network and prepare it for Clop to deploy.
Activities
Clop creates a mutex for persistence and will exit the process if the mutex already exists on the machine, ensuring only one instance of the code runs on a machine. Some variants of Clop perform a language check to determine the location of the affected system, terminating if any of the Commonwealth of Independent States countries are identified. It will also terminate if it detects that it is running in a sandbox environment. Clop attempts to terminate services relating to backup and security, and uses code signing to bypass security policies that require signed code to execute on a system. Clop deletes all Volume Shadow Copies then disables the service. Clop will then attempt to encrypt all reachable non-system files, using a hybrid AES-RSA encryption. After the ransomware is executed, Clop appends variations of the clop extension, such as CIIp, C11p, and C_L_O_P to the encrypted files, and deletes logs from compromised machines to evade detection.
Clop ransomware campaigns commonly use double extortion; a technique which facilitates the theft of data before encrypting it. In March 2020, a Tor-based data leak site titled, CL0P^_- LEAKS was launched where a compromised organisation’s data is publicly exposed if the ransom is not paid.
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 29 April 2021 1:02 pm