Threat Assessment: Clop Ransomware
Summary: Unit 42 reports an uptick in Clop ransomware activity across industries in the U.S., Europe, Canada, Asia Pacific and Latin America, with Clop commonly delivered as the final-stage payload of a malicious spam campaign run by the financially motivated actor TA505. Clop, a variant of the CryptoMix strain, appends extensions such as .clop, .CIIp, .Cllp and .C_L_O_P to victim files, kills backup and security processes, refuses to run in virtual environments, and has been linked to exploitation of four Accellion File Transfer Appliance vulnerabilities (CVE-2021-27101 through CVE-2021-27104) beginning in February.
Bottom line: Clop's operators run a Tor leak site launched in March 2020, target top executives' workstations, dox employees and pitch breaches to reporters - so a single infection can become a public data exposure, not just an encryption event.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Mentions
- CVE-2021-27101CVE-2021-27102CVE-2021-27103CVE-2021-27104
- Related
- CVE-2021-27103: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-27101: Accellion FTA SQL Injection Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-27102: Accellion FTA OS Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021