|

Clop – Ransomware by TA505

ByDetecteam

TLP

TLP CLEAR

Author

Jordi Lobo

Summary

Clop ransomware is a variant of a previously known strain called CryptoMix. In 2019, Clop was delivered as the final payload of a phishing campaign associated with the financially motivated actor TA505. In 2020, Clop has evolved from a ransomware delivered through malicious spam to one being used in targeted campaigns against high-profile companies. Clop appends the .clop extension to the victim’s files. We have observed different variants using different extensions, such as .CIIp, .Cllp and .C_L_O_P. This ransomware includes various features to avoid detection. Observed Clop samples try to kill several processes and services related to backups and security solutions.

DATA

cslogs-1Download

TIMELINE

CATEGORY

Ransomware

references

MITRE ATT&CK

Similar Posts

  • Scattered Spider: Detection Engineering Dilemma

    BySebastien Tricaud

    Scattered Spider is a rapidly emerging threat. As a native English-speaking group, it has quickly become a versatile adversary—ranging from data exfiltration to ransomware deployment. It is referenced in numerous analyses, including but not limited to those by CISA, ReliaQuest, AttackIQ, Unit 42, and Google Cloud. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320ahttps://reliaquest.com/blog/scattered-spider-attack-analysis-account-compromisehttps://www.attackiq.com/2025/05/29/emulating-scattered-spiderhttps://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloudhttps://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applicationshttps://www.tidalcyber.com/blog/scattered-spider-evolving-resilient-group-proves-need-for-constant-defender-vigilance Known Scattered Spider aliases are: 0ktapus, oktapus, UNC3944,…

  • |

    F5 Server Audit

    ByDetecteam

    TLP TLP TLP CLEAR Author Sebastien Tricaud Summary This week, we share data from an actively exploited attack from the CISA Known Exploited Vulnerabilities Catalog. This is the /var/log/audit.log file from the F5 boxes which were compromised. A critical security advisory, CVE-2023-46747, reveals an unauthenticated remote code execution vulnerability in the BIG-IP Configuration utility. This…

  • |

    Adobe Coldfusion Exploitation (CVE-2023-29298) data

    ByDetecteam

    TLP TLP TLP CLEAR Authors Sebastien Tricaud Summary Active Exploitation of Adobe Coldfusion CVE-2023-29298. We are providing data to help teams quickly detect and react to this ongoing threat. DATA TIMELINE CATEGORY Exploit references https://www.rapid7.com/blog/post/2023/07/17/etr-active-exploitation-of-multiple-adobe-coldfusion-vulnerabilities/

  • |

    Detect SSH login after social engineering

    ByDetecteam

    TLP TLP TLP CLEAR Author David DEFLACHE Summary MGM Resorts recently fell victim to a cyberattack orchestrated by a group called Scattered Spider, who employed vishing (voice phishing) techniques to gain access to the company’s systems. The attackers, believed to be in their late teens and early 20s and fluent in English, impersonated an employee…