CL0P Ransomware : Latest Attacks

INTRODUCTION

The Cl0p group has been active since early 2019, leveraging vulnerabilities and exploits to encrypt files for ransom. The ransomware group has recently targeted 43 organizations and exfiltrated sensitive details. This report highlights the breakup of the target organizations, trends observed of Cl0p ransomware in the last six quarters, the initial access leveraged along with CYFIRMA’s ETLM insights, the threat actors’ motives, and recommendations for organizations to prevent similar future incidents.

BREACH DETAILS

Cl0p ransomware group has published the names of the 43 targeted organizations on their ransomware leak site (the sample of exfiltrated data, however, is not yet available).

The following is the graphical breakup of the target organizations’ industries and geographies.

This breakdown gives a clear picture of the targets:

1. Organizations in the Manufacturing sector (37%) are the most targeted, followed by Retail (26%) and Transportation (14%).
2. Organizations in the US (72%), followed by Canada (14%), and then Europe (14%) are predominantly targeted.

Below are the Cl0P ransomware attack trends for the past six quarters (including the current incident).

Technical Details

As part of initial access, it is suspected that Cl0p leveraged the Cleo vulnerability (CVE-2024-50623, CVSS (3.x): 9.8), which is critical to enable unrestricted file uploads and downloads that could lead to remote code execution (a situation which multiple security researchers have highlighted since December 2024). The exploit details of the vulnerability are publicly available.

Based on an OSINT search at the time of writing, it was observed that 1,600,000+ assets are using vulnerable software, which could render them potential targets.

Indicators of Compromise
The following are the IOCs observed in open source with regards to Cleo Vulnerability exploited by Cl0p ransomware.

(Source: Surface Web)

External Threat Landscape Management Insights

Cl0p ransomware is associated with the suspected Russian Cybercriminal Group/Advanced Persistent Threat Actor ‘TA505’ – also known as ‘Evil Corp’ in North America. They are believed to have leveraged the services of Cl0p ransomware multiple times with the possible intent of espionage, monetary benefits, and retribution in geopolitical scenarios.

Our observation of this threat actor has highlighted the group’s proficiency in developing custom malware and attack tools, concocting innovative attack techniques, and working with a clear vision and gameplan while taking the time to avoid security measures and remain undetected within the compromised networks/systems for the longest time possible.

MITRE ATT&CK Techniques

YARA Rules
Following are the YARA rules which can be ingested in SIEM/SOAR solutions to identify any anomalies.
rule Suspicious_IPs_and_Hash {
meta:
author = “Cyfirma”
description = “Detects suspicious IP addresses and MD5 hash”
date = “2025-02-10”
strings:
$ips = “185.181.230.103” | “181.214.147.164” | “176.123.5.126” |
“5.149.249.226” | “209.127.12.38” | “192.119.99.42” |
“176.123.10.115” | “185.162.128.133” | “185.163.204.137” |
“45.182.189.102” | “89.248.172.139” | “103.140.62.43” |
“146.190.133.67” | “162.240.110.250” | “213.136.77.58”
$md5 = “31e0439e6ef1dd29c0db6d96bac59446”
condition:
any of ($ips*) or any of ($md5*)
}

Conclusion

Attacks on organizations using vulnerabilities and exploits as initial access highlight the need and prioritization of patching the vulnerable software and having a robust vulnerability management and patch management process in place.

Threat actors are very well aware of the timelines usually followed by organizations for patching and are poised to exploit the weaknesses in the vulnerabilities despite the risk rating to gain access to the organization’s network.

Recommendations:

Strategic Recommendations

• Ensure there are policies for the configuration of email filtering settings for blocking phishing & spoofed emails, spam, and emails with malicious links/attachments. Configure email settings to validate links on clicks of the users and delete suspicious emails with known bad extensions like .VBS, .BAT, .EXE, .PIF and .SCR to safeguard and take benefits from newly acquired threat intelligence inputs.
• Ensure that the SOC teams are properly funded and have tools to efficiently implement IoCs and analyze file hashes.
• Establish a robust security posture that is thoughtfully layered with a series of security mechanisms and controls in the network to protect the confidentiality, integrity, and availability of critical data.
• Confirm motives/targets of hacker groups mentioned in this report and plan/execute/manage organization-wide strategy/initiatives to improve the security posture.

Management Recommendations

• Provide resources and tools to perform an enterprise-wide evaluation of system files per hash values of IoCs periodically.
• Regularly reinforce awareness of phishing attempts with end-users across the environment and emphasize human weakness in regular mandatory information security training sessions.
• Ensure minimum network exposure for all control system devices and/or systems.
• Conduct thorough identification and prioritization of cyber risks through risk assessments, vulnerability assessments, and system reviews.

Tactical Recommendations

• Apply filters based on IoCs and signature detection to SIEM systems to detect inbound or outbound traffic on systems that contain sensitive information, particularly institutional proprietary data.
• Patch/upgrade to the latest version and validate their authenticity before installing.
• Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events identify and monitor suspicious activities.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.