www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7563
Public Scan
URL:
https://www.darkreading.com/dr-tech/cl0p-in-your-network-how-to-find-out
Submission: On June 27 via api from TR — Scanned from DE
Submission: On June 27 via api from TR — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Events
Close
Back
Events
Events
* SecTor - Canada's IT Security Conference Oct 23-26 - Learn More
* Black Hat USA - August 5-10 - Learn More
Webinars
* Secrets to a Successful Managed Security Service Provider Relationship
Jun 27, 2023
* How to Use Threat Intelligence to Mitigate Third Party Risk
Jun 29, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
Newsletter Sign-Up
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Events
Close
Back
Events
Events
* SecTor - Canada's IT Security Conference Oct 23-26 - Learn More
* Black Hat USA - August 5-10 - Learn More
Webinars
* Secrets to a Successful Managed Security Service Provider Relationship
Jun 27, 2023
* How to Use Threat Intelligence to Mitigate Third Party Risk
Jun 29, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches
Cloud
ICS/OT
Remote Workforce
Perimeter
Analytics
Security Monitoring
Security Monitoring
App Sec
Database Security
Database Security
Risk
Compliance
Compliance
Threat Intelligence
Endpoint
AuthenticationMobile SecurityPrivacy
AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management
Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People
Identity & Access ManagementCareers & People
Physical Security
IoT
DR Global
Middle East & Africa
Middle East & Africa
Black Hat news
Omdia Research
Events
Close
Back
Events
Events
* SecTor - Canada's IT Security Conference Oct 23-26 - Learn More
* Black Hat USA - August 5-10 - Learn More
Webinars
* Secrets to a Successful Managed Security Service Provider Relationship
Jun 27, 2023
* How to Use Threat Intelligence to Mitigate Third Party Risk
Jun 29, 2023
Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
--------------------------------------------------------------------------------
Newsletter Sign-Up
SEARCH
A minimum of 3 characters are required to be typed in the search bar in order to
perform a search.
Announcements
1.
2.
3.
Event
How to Launch a Threat Hunting Program | Webinar <REGISTER>
Event
How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint |
Webinar <REGISTER>
Report
Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top
of Mind | <READ IT NOW>
PreviousNext
Tech News and Analysis
DR Tech
5 MIN READ
DR Technology
CL0P IN YOUR NETWORK? HERE'S HOW TO FIND OUT
Companies targeted by hacking groups with Cl0p ransomware typically have several
chances to catch the attack prior to the payload being deployed, experts say.
Robert Lemos
Contributing Writer, Dark Reading
June 26, 2023
Source: Andrey Popov via Shutterstock
PDF
Widespread attacks against companies and government agencies through a trio of
zero-day vulnerabilities in the MOVEit Managed File Transfer platform has
granted notoriety to the Cl0p ransomware group.
The list of affected data continues to grow, including personal data on millions
of workers investing in the CalPERS pension fund, employee information from more
than 100,000 workers at the BBC and British Airways, sensitive data from the US
Department of Energy, and personal information on citizens of Nova Scotia.
The widespread impact of the attack speaks volumes of the group's technical
capabilities, says Steve Povolny, director of security research at Exabeam, a
cybersecurity and compliance services firm.
"The shift that I see with these large threat actors, especially the ransomware
gangs, [is that] they're well-funded, they're well-resourced, they have large
organizations, and they're not just finding zero days on GitHub anymore," he
says. "These are careful, dedicated, planned attacks that are designed to be
very quiet and then be very loud all at once."
Determining the technical indicators that indicate the adversary behind any
attack is always tricky since tactics change. The following indicators give
organizations a starting point to investigate whether the Cl0p group has
exploited the vulnerabilities in MOVEit file transfer utilities and may be in
the network.
THE MOVEIT ATTACK: 'HUMAN2' FINGERPRINT
The group behind Cl0p has used a number of vulnerabilities in file transfer
services, such as GoAnywhere MFT in January (CVE-2023-0669) and the MOVEit
managed file transfer platforms in late May and early June (CVE-2023-34362).
Initially, the attackers installed a Web shell, named LEMURLOOT, using the name
"human2.aspx" and used commands sent through HTTP requests with the header field
set to "X-siLock-Comment". The advisory from the Cybersecurity and
Infrastructure Security Agency also includes four YARA rules for detecting a
MOVEit breach.
YARA rule for detecting a MOVEit attack. Source: CISA advisory
The attack also leaves behind administrative accounts in associated databases
for persistence — even if the Web server has been completely reinstalled, the
attackers can revive their compromise. Sessions in the "activesessions" database
with Timeout = '9999' or users in the User database with Permission = '30' and
Deleted = '0' may indicate attacker activity, according to CrowdStrike.
One hallmark of the MOVEit attack, however, is that it typically leaves few
technical indicators behind. The extended success of the Cl0p attack against
MOVEit managed file transfer software and the difficulty in finding indicators
of compromise show that product vendors need to spend additional effort on
ensuring that forensically useful logging is available, says Caitlin Condon, a
security manager with vulnerability-management firm Rapid7.
"There's a lot of tracks here — there's a lot to follow," she says. "Often, in
looking to remediate the vulnerability and eradicate threat-actor access, a lot
of companies were completely wiping the application, and that also will wipe the
evidence."
SIGNS OF CL0P RANSOMWARE
At some point during an attack, the Cl0p group will likely deploy ransomware of
the same name. Originally, the malware was installed via phishing attacks, but
increasingly attacks have targeted large organizations, often with exploits for
new or recent vulnerabilities in file transfer or management software.
Typically, the group uses legitimate code-signing certificates to evade
detection by security software. In the past, for example, the Cl0p ransomware
installer has used either a certificate from Corsair Software Solution Inc.
dated Friday, Feb. 12, 2021, or one from Insite Software Inc. dated Friday, Dec.
25, 2020, according to a technical advisory published by Palo Alto Networks.
The attackers will also stop several system processes, including those belonging
to backup programs and security solutions.
Following execution, the Cl0p ransomware appends a variety of extensions to the
victim's files, including .clop, .CIIp, .Cllp, and .C_L_O_P. Ideally, companies
would want to detect the ransomware before the point files are decrypted.
As with any technical indicators, static signatures are of limited use because
attackers will often customize their methods as a way to bypass detection based
on fixed rules, according to cyberthreat experts.
OTHER SIGNS: TRUEBOT AND RASPBERRY ROBIN
Other common technical indicators of the Cl0p group are the ancillary tools they
use to extend their compromise or alternative ways that they gain initial
access.
The Truebot downloader, for example, is a popular intermediary payload that
often leads to a Cl0p infection and is linked to the Silence group. Truebot
often leads to the installation of Cobalt Strike and/or the Grace downloader
malware, according to an analysis by Cisco's Talos group. For exfiltration, a
custom tool known as Teleport is commonly used as well.
Silence has used a worm delivered through USB drives, known as Raspberry Robin,
and sometimes through a third-party pay-per-install service, according to
Microsoft, which now tracks the group under its new taxonomy as Lace Tempest. As
of April, Microsoft noted that Raspberry Robin had been seen in nearly 1,000
organizations by almost 3,000 devices, with Truebot and/or Cobalt Strike
following soon after, as Lace Tempest attempted to compromise more systems.
Raspberry Robin infections can be stopped by using Group Policy or registry
settings to prevent autorun or the execution of code upon inserting a USB drive,
according to Microsoft.
Finally, companies should always look for signs that a large volume of data is
being exfiltrated, especially to infrastructure known to be used by the Cl0p
group, says Mike Stokkel, a senior threat intelligence analyst in NCC Group's
FOX-IT security-services group.
"Standard security measurements can already help by, for example, deploying
[endpoint detection and response] solutions on file transfer applications on a
MOVEit system or a GoAnywhere system," he says. "Using a network sensor and
tracking outgoing outbound network traffic can also help. When you see 600
gigabytes going outside of your network, that's quite an anomaly."
Vulnerabilities/Threats
Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.
Subscribe
More Insights
White Papers
*
9 Traits You Need to Succeed as a Cybersecurity Leader
*
Adopting a Defense-in-Depth Approach to IT Security
More White Papers
Webinars
*
Secrets to a Successful Managed Security Service Provider Relationship
*
How to Use Threat Intelligence to Mitigate Third Party Risk
More Webinars
Reports
*
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
*
How Enterprises Are Managing Application Security Risks in a Heightened
Threat Environment
More Reports
Editors' Choice
Microsoft Teams Attack Skips the Phish to Deliver Malware Directly
Elizabeth Montalbano, Contributor, Dark Reading
Azure AD 'Log in With Microsoft' Authentication Bypass Affects Thousands
Tara Seals, Managing Editor, News, Dark Reading
Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild
Dark Reading Staff, Dark Reading
Lessons From a Pen Tester: 3 Steps to Stay Safer
Jim Broome, President & CTO, DirectDefense
Webinars
* Secrets to a Successful Managed Security Service Provider Relationship
* How to Use Threat Intelligence to Mitigate Third Party Risk
* Making Sense of Security Operations Data
* Finding the Right Role for Identity and Access Management in Your Enterprise
* Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
More Webinars
Reports
* Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
* How Enterprises Are Managing Application Security Risks in a Heightened
Threat Environment
* Successfully Managing Identity in Modern Cloud and Hybrid Environments
* Shoring Up the Software Supply Chain Across Enterprise Applications
* The Promise and Reality of Cloud Security
More Reports
White Papers
* 9 Traits You Need to Succeed as a Cybersecurity Leader
* Adopting a Defense-in-Depth Approach to IT Security
* A Buyer's Guide to Securing Privileged Access
* Top Ten Tips: Securing Multi-Cloud with Modern CSPM
* Cybersecurity in a post pandemic world: A focus on financial services
More White Papers
Events
* SecTor - Canada's IT Security Conference Oct 23-26 - Learn More
* Black Hat USA - August 5-10 - Learn More
More Events
More Insights
White Papers
*
9 Traits You Need to Succeed as a Cybersecurity Leader
*
Adopting a Defense-in-Depth Approach to IT Security
More White Papers
Webinars
*
Secrets to a Successful Managed Security Service Provider Relationship
*
How to Use Threat Intelligence to Mitigate Third Party Risk
More Webinars
Reports
*
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
*
How Enterprises Are Managing Application Security Risks in a Heightened
Threat Environment
More Reports
DISCOVER MORE FROM INFORMA TECH
* Interop
* InformationWeek
* Network Computing
* ITPro Today
* Data Center Knowledge
* Black Hat
* Omdia
WORKING WITH US
* About Us
* Advertise
* Reprints
FOLLOW DARK READING ON SOCIAL
*
*
*
*
*
*
* Home
* Cookies
* Privacy
* Terms
Copyright © 2023 Informa PLC Informa UK Limited is a company registered in
England and Wales with company number 1072954 whose registered office is 5
Howick Place, London, SW1P 1WG.
Cookies Button
ABOUT COOKIES ON THIS SITE
We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. You can choose to accept all of these
cookies or only essential cookies. To learn more or manage your preferences,
click “Settings”. For further information about the data we collect from you,
please see our Privacy Policy
Accept All
Settings
COOKIE PREFERENCE CENTER
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All
MANAGE CONSENT PREFERENCES
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.
Cookies Details
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
Cookies Details
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then
some or all of these services may not function properly.
Cookies Details
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
Cookies Details
Back Button
BACK
Search Icon
Filter Icon
Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
*
View Cookies
* Name
cookie name
Confirm My Choices