MITRE ATT&CKsoftware (malware)
S0611 Clop
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2021-05-10
Description
Clop is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace, telecommunications, professional and legal services, healthcare, and high tech industries. Clop is a variant of the CryptoMix ransomware.
Related
Uses · MITRE ATT&CK (17)
- T1685 Disable or Modify Tools technique
- T1614.001 System Language Discovery sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1218.007 Msiexec sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G0092 TA505 group
References
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/ Mcafee Clop Aug 2019
- https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware Cybereason Clop Dec 2020
- https://unit42.paloaltonetworks.com/clop-ransomware/ Unit42 Clop April 2021