It is reported that the ransomware named "CLOP" is active in attacking
organizations/institutions across the globe. Post compromise this
ransomware leaks information if negotiation deal of ransom fails. Recently
the threat actors behind Clop have stolen and encrypted the sensitive
information of various organizations and after failure of ransom payment,
the stolen information was leaked on their "CL0P^_- LEAKS" data leak
site, hosted on dark web. The leaked information includes data backups,
financial records, thousands of emails and vouchers etc.
After encryption CLOP ransomware appends ".Clop" extension in each file
and generates a text file "ClopReadMe.txt" containing ransom note in each
folder. CLOP ransomware uses RSA (Rivest-Shamir-Adleman) encryption
algorithm and generated keys are stored on a remote server controlled by
Updated versions of Clop have tried to expand their attack vectors through
disabling and removing local security solutions such as Windows Defender
and Microsoft Security Essentials etc. This ransomware has capability of
installing additional password stealing Trojans and other malware
In most cases, Clop is distributed via fake software updates, trojans,
cracks, unofficial software download sources, and spam emails. In the
recent attack on an Indian conglomerate, it is suspected that the bug
(CVE-2019-19781) in the Citrix Netscaler ADC VPN gateway was utilized to
carry out the attack. Unfortunately, as of now no decryptor tool is
available for Clop ransomware.
Indicators of compromise:
For detailed IOC (Hashes, Files etc), please refer the links provide in
Countermeasures and Best practices for prevention:
Do not download and install applications from untrusted sources [offered
via unknown websites/ links on unscrupulous messages]. Install applications
downloaded from reputed application market only.
Update software and operating systems with the latest patches. Outdated
applications and operating systems are the targets of most attacks.
Don't open attachments in unsolicited e-mails, even if they come from
people in your contact list, and never click on a URL contained in an
unsolicited e-mail, even if the link seems benign. In cases of genuine URLs
close out the e-mail and go to the organization's website directly through
Install ad blockers to combat exploit kits such as Fallout that are
distributed via malicious advertising.
Prohibit external FTP connections and blacklist downloads of known
offensive security tools.
All operating systems and applications should be kept updated on a regular
basis. Virtual patching can be considered for protecting legacy systems and
networks. This measure hinders cybercriminals from gaining easy access to
any system through vulnerabilities in outdated applications and software.
Avoid applying updates / patches available in any unofficial channel.
Restrict execution of Power shell /WSCRIPT in an enterprise environment.
Ensure installation and use of the latest version of PowerShell, with
enhanced logging enabled. Script block logging and transcription enabled.
Send the associated logs to a centralized log repository for monitoring and
Establish a Sender Policy Framework (SPF) for your domain, which is an
email validation system designed to prevent spam by detecting email
spoofing by which most of the ransomware samples successfully reaches the
corporate email boxes.
Application whitelisting/Strict implementation of Software Restriction
Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths.
Ransomware sample drops and executes generally from these locations.
Users are advised to disable their RDP if not in use, if required, it
should be placed behind the firewall and users are to bind with proper
policies while using the RDP.
Block the attachments of file types,
Consider encrypting the confidential data as the ransomware generally
targets common file types.
Perform regular backups of all critical information to limit the impact of
data or system loss and to help expedite the recovery process. Ideally,
this data should be kept on a separate device, and backups should be stored
Network segmentation and segregation into security zones - help protect
sensitive information and critical services. Separate administrative
network from business processes with physical controls and Virtual Local