S0611 Clop

malwareEnterprise

platformsWindows

also known asClop

Clop is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace, telecommunications, professional and legal services, healthcare, and high tech industries. Clop is a variant of the CryptoMix ransomware.

techniques used (17)

ATT&CK techniques this enables or maps to.

T1027.002Software Packing
T1057Process Discovery
T1059.003Windows Command Shell
T1083File and Directory Discovery
T1106Native API
T1112Modify Registry
T1135Network Share Discovery
T1140Deobfuscate/Decode Files or Information
T1218.007Msiexec
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1497.003Time Based Checks
T1518.001Security Software Discovery
T1553.002Code Signing
T1614.001System Language Discovery
T1685Disable or Modify Tools

used by groups (1)

Threat groups associated with this.

G0092TA505

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan