Cl0p

Also known as: Clop

Cl0p is a ransomware family whose operators became known for mass data-theft campaigns against managed file transfer products. According to CISA, the group exploited Accellion FTA in 2020 and 2021, GoAnywhere MFT in early 2023 and a MOVEit Transfer zero-day in May 2023, often stealing data for extortion without encrypting anything.

Public attribution and associated actors: MITRE ATT&CK lists Clop as used by TA505. CISA and the FBI attributed the 2023 MOVEit Transfer exploitation campaign to the CL0P ransomware gang, also known as TA505.As publicly reported:Cl0p TA505
First seen: Around 2019
Platforms: Windows
MITRE ATT&CK software entries: S0611 Clop

How it spreads or gets in

Exploitation of vulnerabilities in internet-facing file transfer software, followed by web shells for data access (CISA AA23-158A).
Earlier campaigns used phishing and loaders associated with TA505.

Key behaviours

Stole data in bulk and extorted victims by threatening to leak it.
Installed web shells on compromised file transfer servers.
Where ransomware was deployed, it used code signing and Msiexec to evade defences.

ATT&CK techniques

Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.

Detection ideas

Monitor file transfer servers for new files in web directories and unusual database queries.
Alert on large or unusual downloads from managed file transfer platforms.
Subscribe to vendor and CISA alerts for the file transfer products you run.

Defences that work

Inventory internet-facing file transfer products and patch them as emergencies.
Limit stored data on transfer servers and delete files after use.
Put transfer servers in a segmented zone with tight egress rules.

Incidents involving Cl0p

2023 MOVEit Transfer mass exploitation

Sources

RansomwareATT&CK S0611