Cl0p

Tactics and techniques attributed to CL0P by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

• TA0001Initial Access
  • T1078Valid accounts

    Have been reported to make use of compromised accounts to access victims via RDP.

  • T1190Exploit public-facing application

    Arrives via any the following exploits: CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104, CVE-2021-35211.

  • T1566.001Phishing: Spear-phishing attachment

    Arrives via phishing emails that have Get2 Loader, which will download the SDBot and FlawedAmmy RAT.

• TA0002Execution
  • T1059Command and scripting interpreter

    Uses various scripting interpreters like PowerShell, Windows command shell and Visual Basic (macro in documents).

  • T1106Native API

    Uses native API to execute various commands/routines.

  • T1204User execution

    User execution is needed to carry out the payload from the spear-phishing link/attachments.

• TA0003Persistence
  • T1543.003Create or modify system process: Windows service

    Creates a service to execute the ransomware.

  • T1547Boot or logon autostart execution

    Creates registry run entries to execute the ransomware as a service.

• TA0004Privilege Escalation
  • T1068Exploitation for privilege escalation

    Makes use of CVE-2021-27102 to escalate privilege.

  • T1484.001Domain Policy modification: Group Policy modification

    Uses stolen credentials to access the AD servers to gain administrator privilege and attack other machines within the network.

  • T1574Hijack execution flow

    UAC bypass.

• TA0005Defense Evasion
  • T1036.001Masquerading: invalid code signature

    Makes use of the following digital signatures: DVERI, FADO, TOV.

  • T1055.001Process injection: DLL injection

    To deliver other tools and payload, a tool has the capability to inject its downloaded payload.

  • T1070.001Indicator removal on host: clear Windows event logs

    Clears the Event Viewer log files.

  • T1070.004Indicator removal on host: file deletion

    Deletes traces of itself in the infected machine.

  • T1140Deobfuscate/Decode files or information

    The tool used for exfiltration has a part of its malware trace removal, and it drops a base-64 encoded file.

  • T1202Indirect command execution

    A startup script runs just before the system gets to the login screen via startup registry.

  • T1562.001Impair defenses: disable or modify tools

    Disables security-related software by terminating them.

• TA0007Discovery
  • T1012Query registry

    Queries certain registries as part of its routine.

  • T1018Remote system discovery

    Makes use of tools for network scans.

  • T1057Process discovery

    Discovers certain processes for process termination.

  • T1063Security software discovery

    Discovers security software for reconnaissance and termination.

  • T1082System information discovery

    Identifies keyboard layout and other system information.

  • T1083File and directory discovery

    Searches for specific files and the directory related to its encryption.

• TA0008Lateral Movement
  • T1021.002Remote services: SMB/Windows admin shares

    Drops a copy of the payload to the compromised AD and then creates a service on the target machine to execute the copy of the payload.

  • T1570Lateral tool transfer

    Can make use of RDP to transfer the ransomware or tools within the network.

• TA0009Collection
  • T1005Data from local system

    Might make use of RDP to manually search for valuable files or information.

• TA0010Exfiltration
  • T1567Exfiltration over web service

    DEWMODE web shell extracts list of available files from a MySQL database on the FTA and lists these files and corresponding their metadata. These will then be downloaded using the DEWMODE web shell.

• TA0011Command and Control
  • T1071Application Layer Protocol

    Uses http/s to communicate to its C&C server.

• TA0040Impact
  • T1486Data encrypted for impact

    Uses a combination of Salsa20, AES, and ECDH to encrypt the files and key.

  • T1490Inhibit system recovery

    Deletes shadow copies.