CLOP Ransomware is a fairly new ransomware variant that first emerged in early 2019, when it started to be used in attacks on large enterprises in the United States, Germany, Mexico, India, and Turkey. The number of attacks has been steadily increasing, with a major increase in attacks identified in October 2020. Since then, the ransomware has been used in many attacks on large enterprises and the ransom demands are often huge. An attack on the software company Software AG saw a ransom demand issued for $20 million.
As is the case with well over a dozen of the most prolific ransomware operations, the CLOP ransomware gang exfiltrates data prior to encrypting files. If victims have a valid backup and try to recover their encrypted files without paying the ransom, the group will leak stolen data on the darkweb making it available to other cybercriminal operations. The media are tipped off to the data dumps, and the subsequent coverage can result in companies suffering serious reputational damage. In recent months there have been many class action lawsuits filed following ransomware attacks where stolen data has been leaked online.
CLOP ransomware is believed to be operated by a threat group known as FIN11, which is an arm of a prolific Russian cybercriminal organization known as TA505. FIN11 has targeted many different industries, although recently manufacturing, healthcare and retail have been a major focus. When attacks are conducted on organizations and companies in these sectors, the losses from downtime can be considerable, which increases the likelihood of victims paying the ransom. One attack on the South Korean retailer E-Land saw 23 of its stores close when they were unable to access their IT systems. An attack on the German manufacturer Symrise AG rendered more than 1,000 computers inoperable, causing huge losses as manufacturing was halted. Attacks on the healthcare industry mean patient records cannot be accessed, which places patient safety at risk.
Many ransomware gangs have exploited weaknesses in Remote Desktop Protocol, VPN solutions, and vulnerabilities in software and operating systems to gain they access they need to internal networks to deploy ransomware. However, the initial attack vector in CLOP ransomware attacks (and also many other ransomware variants) is spam email. Large scale spam campaigns are conducted, often targeting certain industry sectors or geographical locations. These are referred to as “spray and pray” campaigns. The aim is to gain access to as many networks as possible. The ransomware gang can then pick and choose which companies are worthwhile attacking with ransomware.
Once CLOP ransomware is installed, detection can be difficult as the threat group has programmed the ransomware to disable antivirus software such as Microsoft Security Essentials and Windows Defender. The key to blocking attacks is to stop the initial infection, which means preventing the spam emails from reaching inboxes where they can be opened by employees.
Blocking the attacks requires an advanced spam filtering solution with robust antivirus protections. SpamTitan, for instance, uses dual antivirus engines to catch known malware variants and sandboxing to identify malicious attachments containing previously unknown malware, ransomware, or malicious scripts. Machine learning techniques are also employed to identify emerging threats in real time.
The spam emails used in these campaigns try to obtain credentials such Office 365 logins and passwords or get users to download malware downloaders. Additional protection against this phase of the attack can be provided by a web filter such as WebTitan. WebTitan blocks the phishing component of these attacks by preventing these malicious URLs from being accessed by employees, as well as blocking downloads of malware from the Internet.
Staff training is also important to help employees recognize phishing emails and multi-factor authentication should be implemented to prevent stolen credentials from being used to access email accounts and cloud apps.
If you want to improve your security defenses against ransomware, malware and phishing attacks, give the TitanHQ team a call and ask about SpamTitan and WebTitan. Both solutions are available on a free trial to allow you to see for yourself how effective they are at blocking threats and how easy the are to implement and use.