RansomwareFinancial gain
Cl0p
Also known as: CL0P, Clop
Cl0p is known for mass data-theft campaigns that exploit zero-day vulnerabilities in file transfer products, hitting many organisations at once and then extorting them, often without encrypting anything. Its 2023 MOVEit campaign affected a very large number of organisations worldwide.
- Public attribution
- A ransomware and extortion operation; CISA states the CL0P Ransomware Gang is also known as TA505.
- Active since
- Around 2019
- Targets
- Organisations running managed file transfer (MFT) software
- Finance, education, healthcare, government and many other sectors
- Tracked by MITRE ATT&CK as software
- S0611 Clop
Notable campaigns
2020-2021Accellion FTA
Zero-day exploitation of Accellion File Transfer Appliance devices (CISA).
2023Fortra GoAnywhere MFT
Zero-day exploitation of GoAnywhere MFT servers in early 2023 (CISA).
2023MOVEit Transfer
From May 27, 2023, exploitation of a SQL injection zero-day (CVE-2023-34362) to install the LEMURLOOT web shell and steal data.
Signature ATT&CK techniques
- T1190Exploit Public-Facing Application
- T1505.003Server Software Component: Web Shell
- T1218.007System Binary Proxy Execution: Msiexec
- T1553.002Subvert Trust Controls: Code Signing
- T1489Service Stop
- T1490Inhibit System Recovery
- T1486Data Encrypted for Impact
Selected from MITRE ATT&CK's software entry and the cited government advisory.
Defences that work against this actor
- Inventory internet-facing file transfer products and be ready to take them offline the day a zero-day is announced.
- Put MFT servers behind access controls so only partners can reach them, and minimise how long files are retained there.
- Monitor MFT web directories for new files (web shells) and database for bulk exports.
- Plan for extortion without encryption: know what data each system holds.