Clop ransomware gang likely linked to MOVEit data theft attacks

The Clop ransomware gang was recently found to be associated with attacks exploiting a zero-day vulnerability in the MOVEit Transfer platform to steal organizational data.

Microsoft attributes the attacks exploiting the CVE-2023-34362 MOVEit Transfer zero-day vulnerability to Lace Tempest, a group well-known for ransomware operations and running the Clop extortion website.

The attackers have used similar vulnerabilities in the past to steal data and extort victims.

Last week, we discovered that attackers were exploiting a zero-day vulnerability in MOVEit Transfer servers to steal organizational data.

MOVEit Transfer is a Managed File Transfer (MFT) solution that allows enterprises to securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads.

It is believed that these attacks began on 27 May, with data from many organizations being stolen during the attacks.

Attackers exploited the MOVEit zero-day vulnerability to place specially crafted webshells on the servers, allowing them to retrieve lists of files stored on the servers, download files, and steal credentials or keys for configured Azure Blob storage containers.

Webshell installed during the MOVEit attack

While it was not clear at the time who was behind these attacks, the Clop ransomware gang was widely believed to be the culprit due to similarities with previous attacks conducted by the group.

The Clop ransomware operation targets managed file transfer software, having previously used a GoAnywhere MFT zero-day in January 2023 for data theft attacks, and also zero-day exploits against Accellion FTA servers in 2020.

These attacks are being linked by Microsoft to "Lace Tempest", which is commonly referred to as TA505, FIN11, or DEV-0950.

So far, the Clop ransomware operation has not started extorting victims, and victims have not yet received ransom demands.

However, the Clop gang is known to wait several weeks after stealing data before emailing their demands to company executives.

"We deliberately did not disclose your organization, wanting to negotiate with you and your leadership first," read the Clop ransom note sent during the GoAnywhere ransom attacks. "If you do not respond, we will sell your information on the black market and publish it on our blog, which gets 300,000 to 500,000 visitors daily. You can learn about us by searching for the Clop hacking group."

Historically, once Clop starts extorting victims, they add a flurry of new victims to their data leak site, threatening that the stolen files will be published soon to apply further pressure on their extortion schemes.

It was more than a month after the GoAnywhere attack before we saw the list of victims on the gang's extortion website.

The Cyber Security Next Generation (CSNG) simulation attack library already includes the attack methods of the Clop ransomware. You can search for the keyword "Clop" in the CSNG Security Metric Validation Platform to obtain relevant attack simulation experiments, thereby verifying whether your security defense system can effectively cope with the various attack techniques used by this organization.