Quick links
Press Enter to search, Esc to close
Malware profile
Clop is ransomware for Windows that locks files and adds its own file extension.
In short
Clop is ransomware for Windows that locks files and adds its own file extension. MITRE says it was first observed in February 2019 and is a variant of the CryptoMix ransomware. CISA and the FBI describe the CL0P gang as using it for extortion, and in later campaigns mostly stealing data instead of encrypting it.
Clop locks files on a Windows computer and makes recovery harder. It searches folders for files to encrypt, lists network shares, and tries to stop backup and security tools.
CISA says the CL0P gang was previously known for double extortion, which means stealing victim data as well as encrypting it, and threatening to publish it. From 2021 the gang preferred to rely mostly on data theft over encryption.
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Clop | MITRE ATT&CK software S0611[1] |
| CL0P | Spelling used by CISA and the FBI in advisory AA23-158A[2, 3] |
| CL0P Ransomware Gang | Name CISA and the FBI use for the group that used it, also known as TA505[2, 3] |
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Data Encrypted for Impact T1486
It encrypts files with AES, RSA and RC4 and adds the ".clop" extension to them.[1]
Inhibit System Recovery T1490
It deletes shadow copies with vssadmin and uses bcdedit to switch off recovery options.[1]
Service Stop T1489
It can kill processes and services linked to backups and security tools.[1]
System Binary Proxy Execution: Msiexec T1218.007
It can use msiexec.exe to disable security tools.[1]
Obfuscated Files or Information: Software Packing T1027.002
The malware has been packed to help avoid detection.[1]
Virtualization/Sandbox Evasion: Time Based Checks T1497.003
It has used the sleep command to avoid sandbox detection.[1]
Deobfuscate/Decode Files or Information T1140
It has used a simple XOR operation to decrypt strings.[1]
System Location Discovery: System Language Discovery T1614.001
It checks the keyboard language so it avoids installing on Russian-language and other CIS-language machines.[1]
File and Directory Discovery T1083
It has searched folders and subfolders for files to encrypt.[1]
Network Share Discovery T1135
It can list network shares.[1]
Software Discovery: Security Software Discovery T1518.001
It can search for processes that carry antivirus and antimalware product names.[1]
CISA and the FBI say that Clop was offered as ransomware as a service and used in large spear-phishing campaigns, one of which used a verified and digitally signed binary to get past defenses. In 2019, the TA505 group used Clop as the final payload of a phishing campaign that began with a macro-enabled document. In later campaigns the gang exploited previously unknown flaws in file transfer products, including Accellion FTA in 2020 and 2021, GoAnywhere MFT in early 2023 and MOVEit Transfer from May 2023, to steal data from the servers.
TA505 used CL0P as the final payload of a phishing campaign that began with a macro-enabled document.[2]
TA505 used several zero-day flaws to install a web shell named DEWMODE on internet-facing Accellion FTA servers.[2]
In recent campaigns, CL0P preferred to rely mostly on data exfiltration over encryption.[2]
The CL0P group used a zero-day flaw, CVE-2023-0669, against GoAnywhere MFT and claimed data from about 130 victims over 10 days.[2]
CISA and the FBI say TA505 began exploiting CVE-2023-34362 in MOVEit Transfer and installed a web shell named LEMURLOOT to steal data.[2]
The advisory was re-released to remove old GoAnywhere campaign IP addresses and add new ones.[2]
MITRE describes Clop as a ransomware family first observed in February 2019 and a variant of the CryptoMix ransomware. It runs on Windows.
No. CISA says the CL0P gang was previously known for double extortion, which is stealing and encrypting data and then publishing it. From 2021 the gang preferred to rely mostly on data theft over encryption.
MITRE lists the group TA505. CISA and the FBI, in advisory AA23-158A of 7 June 2023, say the CL0P Ransomware Gang is also known as TA505.
CISA and the FBI say the gang began exploiting CVE-2023-34362 in MOVEit Transfer on May 27, 2023. They installed a web shell named LEMURLOOT and used it to steal data from the servers.
CISA and the FBI advise patching internet-facing software, keeping offline and immutable backups, limiting RDP and scripting, and segmenting the network. Advisory AA23-158A also carries YARA rules.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.