Como interromper os ataques do Clop Ransomware com o Illumio

The ransomware landscape is a complex, volatile space. Variants come and go, developers borrow and steal from each other, and affiliates add their own bespoke customizations. This can make it difficult to know who or what exactly you’re dealing with when a breach strikes. It can also make two separate attacks from nominally the same collective potentially very different from each other.

Apesar de toda essa complexidade e mudança, uma permanente nos últimos anos foi o grupo Clop. Ela comprometeu organizações tão diversas quanto escritórios de advocacia globais e fabricantes de aeronaves, acumulando centenas de milhões de dólares no processo.

Fortunately for Illumio customers, we can stop Clop attacks from turning into cyber disasters. It all boils down to understanding how critical network assets communicate with each other and then blocking non-essential connections at scale.

O que é Clop?

Clop is one of the wealthiest ransomware groups around. Reports say money launderers connected with the outfit have tried to conceal at least $500 million. The real figure for revenues from ransomware is certain to be way higher. The malware first appeared in 2019, a variant of a previous strain known as CryptoMix. Over the succeeding years, it was set to work targeting sectors as diverse as transportation and logistics, education, manufacturing, healthcare and retail.

Clop has been associated with multiple initial access vectors in the past — from direct phishing attacks to zero-day exploits targeting a single file transfer software provider. The latter technique, highly unusual in the ransomware space, garnered the group global notoriety and many corporate victims.

One common thread linking most of these attacks is that of "double extortion." Now commonplace among ransomware actors, it was popularized by groups like Clop. In such an attack, victim organizations not only find their most sensitive data and systems encrypted, but they might also suffer a serious data breach. It effectively raises the stakes for corporate victims. You might have backups for the encrypted data. But if the bad guys have stolen sensitive IP or highly regulated customer data, that’s going to change any risk calculation significantly.

Como funciona o Clop?

While there’s plenty of variation in Clop attacks, one particular pattern is instructive in the modus operandi of affiliates. It exploits misconfigured Active Directory (AD) systems to compromise those AD accounts with domain privileges. This provides attackers with the keys to the kingdom, enabling them to:

• Execute comandos remotos, como scripts WMI e PowerShell, no endpoint comprometido e em qualquer outro sistema conectado a ele via AD.
• Mantenha a persistência em um sistema comprometido criando novas contas ou criando/modificando processos do sistema. Os agentes de ameaças também podem executar comandos ou inicializar scripts automaticamente na inicialização ou no login — em qualquer ativo em rede conectado via AD.

With these tools in their arsenal, Clop attackers can move fairly easily through compromised organizations, deploying the ransomware and finding and exfiltrating sensitive data. They must connect to the public internet to do so, in order to download additional tooling and upload the stolen data.

Como parar o Clop

In this scenario, neutralizing the Clop threat requires security teams to gain granular insight into how their AD setup works. By removing domain privilege access from accounts that don’t need it — i.e., enforcing “least privilege” principles — they can reduce the attack surface significantly. Next, restrict the common pathways such an attack might look to exploit, including WinRM, NetBIOS and SMB.

Como a Illumio pode ajudar

Illumio helps some of the world’s largest organizations to thwart attacks from Clop and any other ransomware group. We do this by providing streamlined, scalable policy management to help enforce Zero Trust segmentation.

Com o Illumio, você pode entender em tempo real como os ativos de rede se comunicam entre si e com a Internet pública. Depois, você pode tomar decisões estratégicas sobre quais caminhos manter abertos e quais bloquear — reduzindo a superfície de ataque e deixando os bandidos sem boas opções.

Resumindo, o Illumio pode ajudar a impedir o ransomware Clop ao:

• Mapeando todas as instâncias e conexões do Active Directory
• Identificação de conexões essenciais de entrada/saída
• Implantação rápida de políticas para restringir comunicações não essenciais em grande escala e monitorar quaisquer caminhos que tenham sido deixados abertos

Like most groups, Clop is resilient. Just days after a major law enforcement crackdown led to arrests, it was back up and compromising victims. The only way to tackle this kind of persistence is with sophisticated Zero Trust segmentation from Illumio.

To read more about how Illumio helps contain ransomware attacks, contact us today.