How to detect if Clop ransomware has penetrated your network

Experts state that companies targeted by the hacking group equipped with Clop ransomware usually have several opportunities to catch the attack before the payload is deployed.

The Clop ransomware group is notorious for its widespread attacks on companies and government agencies exploiting three zero-day vulnerabilities in the MOVEit managed file transfer platform.

The list of affected data continues to grow, including personal data of millions of employees invested in the California Public Employees' Retirement System (CalPERS), employee information of over 100,000 staff at the British Broadcasting Corporation (BBC) and British Airways, sensitive data from the US Department of Energy, and personal information of citizens in Nova Scotia.

Steve Povolny, director of security research at cybersecurity and compliance services firm Exabeam, said the broad impact of this attack fully demonstrates the group's technical capabilities.

He said, "I think the shift with these large threat actors, particularly ransomware groups, is that they are well-funded, well-resourced, large organizations that are no longer just looking on GitHub for zero-days. They are launching careful, focused, planned campaigns, with the goal of making a massive impact once they strike."

Due to shifting tactics, identifying the technical indicators of the adversary behind any attack has always been tricky. The following indicators provide organizations with a starting point to investigate whether the Clop group has exploited vulnerabilities in the MOVEit file transfer utility and might be present in the network.

▍MOVEit Attacks: The "Human2" Fingerprint

The group behind Clop has exploited numerous vulnerabilities in file transfer services, such as GoAnywhere MFT in January (CVE-2023-0669), and the MOVEit managed file transfer platform in late May and early June (CVE-2023-34362).

Initially, the attackers installed a Web shell named LEMURLOOT using the file name "human2.aspx" and used commands sent via HTTP requests with the header field set to "X-siLock-Comment". The following YARA rule is used to detect MOVEit breaches.

YARA Rule for Detecting MOVEit Attacks

▍YARA Rule for Detecting MOVEit Attacks

This attack also leaves administrative accounts in the associated database for persistence—allowing attackers to resume their attacks even if the Web server has been completely reinstalled. CrowdStrike suggests that sessions with Timeout = '9999' in the "activesessions" database, or users with Permission = '30' and Deleted = '0' in the User database, could indicate attacker activity.

However, a characteristic of MOVEit attacks is that they typically leave very few technical indicators behind. Caitlin Condon, security manager at vulnerability management firm Rapid7, said the Clop attacks against MOVEit managed file transfer software have been a huge success, and signs of attack are hard to find, suggesting that product vendors need to spend more effort to ensure they provide legitimately useful logging.

She said, "There are a lot of trails here—there's a lot to track. Often, in an effort to patch the vulnerability and eradicate attacker access, many companies completely wipe the application, which also wipes the evidence."

▍Signs of Clop Ransomware

At some point during the attack process, the Clop group may deploy their eponymous ransomware. Initially, the malware was installed through phishing attacks, but increasingly, attacks target large organizations, typically exploiting new or recent vulnerabilities in file transfer or management software.

Typically, the group uses legitimate code signing certificates to evade detection by security software. For example, according to a technical advisory released by Palo Alto Networks, the Clop ransomware installer has previously used certificates issued to Corsair Software Solution Inc. (dated Friday, Feb. 12, 2021) or Insite Software Inc. (dated Friday, Dec. 25, 2020).

Attackers will also stop several system processes, including those belonging to backup programs and security solutions.

Upon execution, Clop ransomware appends various extensions to the victim's files, including .clop, .Ciip, .Cllp, and .C_L_O_P. Ideally, companies would want to detect the ransomware before files are encrypted.

Cyber threat experts state that, as with any technical indicator, static signatures have limited utility because attackers typically customize their methods as a way to bypass fixed rule-based detection.

▍Other Signs: Truebot and Raspberry Robin

Other common technical indicators of the Clop group are the helper tools they use to expand the attacks or alternative methods of gaining initial access.

For example, the Truebot downloader is a popular intermediate payload that frequently leads to Clop infections and is associated with the Silence group. Analysis shows that Truebot often leads to the installation of Cobalt Strike and/or the Grace downloader malware. For exfiltration, a custom tool known as Teleport is also commonly used.

According to Microsoft, Silence uses a worm that propagates via USB drives called "Raspberry Robin," sometimes distributed through pay-per-install services of third parties. Microsoft now attributes the group to Lace Tempest. As of April this year, Microsoft noted that Raspberry Robin had been used on nearly 3,000 devices across nearly 1,000 organizations, with Truebot and/or Cobalt Strike close behind, as Lace Tempest attempts to compromise more systems.

Microsoft states that Raspberry Robin infections can be blocked by using Group Policy or registry settings to prevent autorun or execution of code when USB drives are inserted.

Finally, Mike Stokkel, senior threat intelligence analyst at Fox-IT (an NCC Group company), says that enterprises should always look for signs of large amounts of data being stolen, especially utilizing infrastructure known to be used by the Clop group.

He said, "Standard security measures can already help, for example, deploying endpoint detection and response solutions on the file transfer applications on the MOVEit systems or GoAnywhere systems, or using network sensors and tracking outbound network traffic will also help. When you see 600 gigabytes of data flowing out of your network, that is quite anomalous."

Clop ransomware is currently being heavily exploited. Previously, we also discovered that the cybercrime group FIN7 targeted victims by deploying the Clop ransomware payload. Therefore, the strength of Clop should not be underestimated. Security Validation recommends that enterprises timely validate their security systems and the defensive capabilities of their security products to ensure they are adequately prepared for defence.

The Security simulated attack library already contains the attack methods of Clop ransomware. You can search for the keyword "Clop" in the Security Measure and Verification platform to access relevant attack simulation experiments, thereby verifying whether your security defence system can effectively counter various attack techniques used by this group.