www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7563
Public Scan
URL:
https://www.darkreading.com/dr-tech/cl0p-in-your-network-how-to-find-out
Submission: On June 27 via api from TR — Scanned from DE
Submission: On June 27 via api from TR — Scanned from DE
Form analysis
0 forms found in the DOMText Content
The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * Secrets to a Successful Managed Security Service Provider Relationship Jun 27, 2023 * How to Use Threat Intelligence to Mitigate Third Party Risk Jun 29, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > Newsletter Sign-Up The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * Secrets to a Successful Managed Security Service Provider Relationship Jun 27, 2023 * How to Use Threat Intelligence to Mitigate Third Party Risk Jun 29, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More Webinars * Secrets to a Successful Managed Security Service Provider Relationship Jun 27, 2023 * How to Use Threat Intelligence to Mitigate Third Party Risk Jun 29, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > -------------------------------------------------------------------------------- Newsletter Sign-Up SEARCH A minimum of 3 characters are required to be typed in the search bar in order to perform a search. Announcements 1. 2. 3. Event How to Launch a Threat Hunting Program | Webinar <REGISTER> Event How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint | Webinar <REGISTER> Report Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top of Mind | <READ IT NOW> PreviousNext Tech News and Analysis DR Tech 5 MIN READ DR Technology CL0P IN YOUR NETWORK? HERE'S HOW TO FIND OUT Companies targeted by hacking groups with Cl0p ransomware typically have several chances to catch the attack prior to the payload being deployed, experts say. Robert Lemos Contributing Writer, Dark Reading June 26, 2023 Source: Andrey Popov via Shutterstock PDF Widespread attacks against companies and government agencies through a trio of zero-day vulnerabilities in the MOVEit Managed File Transfer platform has granted notoriety to the Cl0p ransomware group. The list of affected data continues to grow, including personal data on millions of workers investing in the CalPERS pension fund, employee information from more than 100,000 workers at the BBC and British Airways, sensitive data from the US Department of Energy, and personal information on citizens of Nova Scotia. The widespread impact of the attack speaks volumes of the group's technical capabilities, says Steve Povolny, director of security research at Exabeam, a cybersecurity and compliance services firm. "The shift that I see with these large threat actors, especially the ransomware gangs, [is that] they're well-funded, they're well-resourced, they have large organizations, and they're not just finding zero days on GitHub anymore," he says. "These are careful, dedicated, planned attacks that are designed to be very quiet and then be very loud all at once." Determining the technical indicators that indicate the adversary behind any attack is always tricky since tactics change. The following indicators give organizations a starting point to investigate whether the Cl0p group has exploited the vulnerabilities in MOVEit file transfer utilities and may be in the network. THE MOVEIT ATTACK: 'HUMAN2' FINGERPRINT The group behind Cl0p has used a number of vulnerabilities in file transfer services, such as GoAnywhere MFT in January (CVE-2023-0669) and the MOVEit managed file transfer platforms in late May and early June (CVE-2023-34362). Initially, the attackers installed a Web shell, named LEMURLOOT, using the name "human2.aspx" and used commands sent through HTTP requests with the header field set to "X-siLock-Comment". The advisory from the Cybersecurity and Infrastructure Security Agency also includes four YARA rules for detecting a MOVEit breach. YARA rule for detecting a MOVEit attack. Source: CISA advisory The attack also leaves behind administrative accounts in associated databases for persistence — even if the Web server has been completely reinstalled, the attackers can revive their compromise. Sessions in the "activesessions" database with Timeout = '9999' or users in the User database with Permission = '30' and Deleted = '0' may indicate attacker activity, according to CrowdStrike. One hallmark of the MOVEit attack, however, is that it typically leaves few technical indicators behind. The extended success of the Cl0p attack against MOVEit managed file transfer software and the difficulty in finding indicators of compromise show that product vendors need to spend additional effort on ensuring that forensically useful logging is available, says Caitlin Condon, a security manager with vulnerability-management firm Rapid7. "There's a lot of tracks here — there's a lot to follow," she says. "Often, in looking to remediate the vulnerability and eradicate threat-actor access, a lot of companies were completely wiping the application, and that also will wipe the evidence." SIGNS OF CL0P RANSOMWARE At some point during an attack, the Cl0p group will likely deploy ransomware of the same name. Originally, the malware was installed via phishing attacks, but increasingly attacks have targeted large organizations, often with exploits for new or recent vulnerabilities in file transfer or management software. Typically, the group uses legitimate code-signing certificates to evade detection by security software. In the past, for example, the Cl0p ransomware installer has used either a certificate from Corsair Software Solution Inc. dated Friday, Feb. 12, 2021, or one from Insite Software Inc. dated Friday, Dec. 25, 2020, according to a technical advisory published by Palo Alto Networks. The attackers will also stop several system processes, including those belonging to backup programs and security solutions. Following execution, the Cl0p ransomware appends a variety of extensions to the victim's files, including .clop, .CIIp, .Cllp, and .C_L_O_P. Ideally, companies would want to detect the ransomware before the point files are decrypted. As with any technical indicators, static signatures are of limited use because attackers will often customize their methods as a way to bypass detection based on fixed rules, according to cyberthreat experts. OTHER SIGNS: TRUEBOT AND RASPBERRY ROBIN Other common technical indicators of the Cl0p group are the ancillary tools they use to extend their compromise or alternative ways that they gain initial access. The Truebot downloader, for example, is a popular intermediary payload that often leads to a Cl0p infection and is linked to the Silence group. Truebot often leads to the installation of Cobalt Strike and/or the Grace downloader malware, according to an analysis by Cisco's Talos group. For exfiltration, a custom tool known as Teleport is commonly used as well. Silence has used a worm delivered through USB drives, known as Raspberry Robin, and sometimes through a third-party pay-per-install service, according to Microsoft, which now tracks the group under its new taxonomy as Lace Tempest. As of April, Microsoft noted that Raspberry Robin had been seen in nearly 1,000 organizations by almost 3,000 devices, with Truebot and/or Cobalt Strike following soon after, as Lace Tempest attempted to compromise more systems. Raspberry Robin infections can be stopped by using Group Policy or registry settings to prevent autorun or the execution of code upon inserting a USB drive, according to Microsoft. Finally, companies should always look for signs that a large volume of data is being exfiltrated, especially to infrastructure known to be used by the Cl0p group, says Mike Stokkel, a senior threat intelligence analyst in NCC Group's FOX-IT security-services group. "Standard security measurements can already help by, for example, deploying [endpoint detection and response] solutions on file transfer applications on a MOVEit system or a GoAnywhere system," he says. "Using a network sensor and tracking outgoing outbound network traffic can also help. When you see 600 gigabytes going outside of your network, that's quite an anomaly." Vulnerabilities/Threats Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe More Insights White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Adopting a Defense-in-Depth Approach to IT Security More White Papers Webinars * Secrets to a Successful Managed Security Service Provider Relationship * How to Use Threat Intelligence to Mitigate Third Party Risk More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment More Reports Editors' Choice Microsoft Teams Attack Skips the Phish to Deliver Malware Directly Elizabeth Montalbano, Contributor, Dark Reading Azure AD 'Log in With Microsoft' Authentication Bypass Affects Thousands Tara Seals, Managing Editor, News, Dark Reading Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild Dark Reading Staff, Dark Reading Lessons From a Pen Tester: 3 Steps to Stay Safer Jim Broome, President & CTO, DirectDefense Webinars * Secrets to a Successful Managed Security Service Provider Relationship * How to Use Threat Intelligence to Mitigate Third Party Risk * Making Sense of Security Operations Data * Finding the Right Role for Identity and Access Management in Your Enterprise * Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment * Successfully Managing Identity in Modern Cloud and Hybrid Environments * Shoring Up the Software Supply Chain Across Enterprise Applications * The Promise and Reality of Cloud Security More Reports White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Adopting a Defense-in-Depth Approach to IT Security * A Buyer's Guide to Securing Privileged Access * Top Ten Tips: Securing Multi-Cloud with Modern CSPM * Cybersecurity in a post pandemic world: A focus on financial services More White Papers Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Black Hat USA - August 5-10 - Learn More More Events More Insights White Papers * 9 Traits You Need to Succeed as a Cybersecurity Leader * Adopting a Defense-in-Depth Approach to IT Security More White Papers Webinars * Secrets to a Successful Managed Security Service Provider Relationship * How to Use Threat Intelligence to Mitigate Third Party Risk More Webinars Reports * Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment More Reports DISCOVER MORE FROM INFORMA TECH * Interop * InformationWeek * Network Computing * ITPro Today * Data Center Knowledge * Black Hat * Omdia WORKING WITH US * About Us * Advertise * Reprints FOLLOW DARK READING ON SOCIAL * * * * * * * Home * Cookies * Privacy * Terms Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Cookies Button ABOUT COOKIES ON THIS SITE We and our partners use cookies to enhance your website experience, learn how our site is used, offer personalised features, measure the effectiveness of our services, and tailor content and ads to your interests while you navigate on the web or interact with us across devices. You can choose to accept all of these cookies or only essential cookies. To learn more or manage your preferences, click “Settings”. For further information about the data we collect from you, please see our Privacy Policy Accept All Settings COOKIE PREFERENCE CENTER When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Cookies * Name cookie name Confirm My Choices