Clop Ransomware in Action: A Comprehensive Analysis of Its Multi-Stage Tactics

Abstract

Recently, Clop ransomware attacks targeting non-IT fields such as distribution, logistics, and manufacturing have been rapidly increasing. These advanced attacks are particularly concentrated on Active Directory (AD) servers, causing significant operational and financial disruption to the affected organizations. In this study, the multi-step behavior of Clop ransomware was deeply investigated to decipher the sequential techniques and strategies of attackers. One of the key insights uncovered is the vulnerability in AD administrator accounts, which are often used as a primary point of exploitation. This study aims to provide a comprehensive analysis that enables organizations to develop a deeper understanding of the multifaceted threats posed by Clop ransomware and to build more strategic and robust defenses against them.

1. Introduction

Clop ransomware systematically targets and exploits Active Directory (AD) servers, which are critical for managing user and computer permissions within various institutional and corporate networks. Such ransomware harms institutions and businesses by causing widespread damage and making recovery efforts difficult. Additionally, ransomware is uniquely designed to prevent system encryption in specific regions [1,2].

According to recent research and reports from around the world, including South Korea, ransomware attacks in the second quarter of 2023 were confirmed to have more than doubled compared to the same period last year [3]. According to the ‘Kara Ransomware Trend Report’ published by Shields Communication Group, there were 1311 ransomware attacks this quarter, an increase of 112% compared to the same period last year and 40.5% compared to the previous quarter. This significant upward trend is believed to be largely due to the aggressive activity of emerging ransomware groups, particularly Clop, which launched widespread attacks in May 2023 by exploiting vulnerabilities in the MOVEIt Transfer software (version 15.0 and earlier, CVE-2023-34362) file transfer software. MOVEIt is a managed file transfer (MFT) solution that is widely used in enterprise environments to securely transfer data between systems. The exploitation of vulnerabilities in MOVEIt allowed Clop ransomware to gain unauthorized access to sensitive files and spread within the network, further exacerbating the damage caused by the attack [4,5,6,7].

This study aims to decipher the attackers’ advanced techniques and strategies through an in-depth analysis of the multi-step behavior of Clop ransomware [8]. In particular, vulnerabilities in AD administrator accounts, which are frequently exploited as key entry points, are identified [9]. By providing a comprehensive analysis, organizations are helped to thoroughly understand the multifaceted threat posed by Clop ransomware and to design more strategic and robust defenses [10].

To achieve the objective, this study will use a mixed methods approach. Quantitative data analysis is used to identify general patterns and trends in Clop ransomware attacks, while qualitative case studies provide deeper insight into specific incidents. This integrated approach provides a holistic view of the Clop ransomware threat landscape and helps develop effective countermeasures [11,12].

The organization of this paper is as follows: Section 2 discusses the characteristics of Clop ransomware, Section 3 is dedicated to the analysis of Clop ransomware hacking attacks, Section 4 presents countermeasures against Clop ransomware discovered through analysis, and finally, the study is concluded in Section 5.

2. Methodology

This study utilizes both qualitative and quantitative research methods to analyze Clop ransomware. Data was collected from various sources, including actual ransomware samples, public and private security reports, and simulated environments. The screenshots presented in this paper were obtained through controlled experiments conducted in a secure lab environment where Clop ransomware was executed in isolated systems. These systems were designed to mimic real-world enterprise environments, allowing for the capture of detailed information regarding the ransomware’s behavior at each stage of its attack lifecycle. Additionally, the study analyzes data from real-world incidents reported by cybersecurity organizations to provide a comprehensive understanding of Clop’s impact.

3. Attack Characteristics of Clop Ransomware

Clop ransomware is generally known to target and attack AD servers, which are important for managing important resources of organizations such as institutions and companies. Unlike traditional ransomware, which displays cryptocurrency wallet addresses, Clop ransomware warns users that their system is infected and then provides an email address for potential negotiations. This systematic targeting allows Clop ransomware to exact a large portion of institutional and corporate systems as ransom [13,14].

A characteristic of Clop ransomware is that it renames encrypted files by adding the ‘.clop’ extension. That is, the ransomware is given the name ‘Clop Ransomware’. In particular, Klopp is well-known for deliberately avoiding Russia’s encryption system and the 12 languages of the Russian Federation. This behavior is speculated to be a tactic employed by cybercriminals to avoid legal repercussions from Russian authorities, as the ransomware is less likely to draw attention from local law enforcement if it avoids targeting Russian-speaking regions. This strategic evasion indicates that the actors behind Clop are likely aware of and seek to avoid conflicts with Russian cybercrime regulations [15,16].

Clop ransomware is known to bypass the security solutions of organizations such as individual institutions and corporations and infiltrate organizations through carefully crafted spear phishing emails. These social engineering emails contain ransomware malware. Once executed, the malware tries to establish a connection to a Command and Control (C&C) server and sends additional malware to all connected systems [17,18].

The attack consists of four stages. These stages are characteristic of Advanced Persistent Threat (APT) attacks, which involve long-term, targeted cyberattacks with the intent to steal, disrupt, or gain access to sensitive information. Although Clop ransomware typically behaves as a financially motivated attack, its methodical approach to infiltrating networks, escalating privileges, and spreading laterally within compromised environments aligns with APT strategies. This indicates a sophisticated level of planning and execution typically associated with state-sponsored or highly organized cybercrime groups.

• Initial Infiltration: Spear phishing email attacks combined with social engineering techniques are carried out to establish an initial base within an organization.
• Lateral Movement: Once the initial point of entry is secured, ransomware spreads internally by exploiting vulnerabilities in Windows Server Message Block (SMB) protocols.
• Escalation of Privilege: Once a hacker gains control of the administrator PC that manages a domain controller (DC), they install shellcode and memory hacking tools to gain control over the DC.
• Ransomware Propagation: All systems connected to the domain controller are infected with ransomware.

Understanding the four steps makes it clear that Clop ransomware’s attack strategy is designed to exploit specific vulnerabilities in corporate networks. Therefore, it is essential for organizations to implement strong security measures to prevent and mitigate ransomware attacks.

4. Analysis of a Clop Ransomware Hacking Attack Case

In this section, a hacking attack by Clop ransomware is analyzed step by step to decipher the sequential techniques and strategies of the attackers.

4.1. Distribution of Reconnaissance

To provide a clearer understanding and facilitate rapid detection, the key Indicators of Compromise (IoCs) identified throughout this study are summarized in the following

Table 1. Summary of Indicators of Compromise (IoCs) for Clop Ransomware.

Indicator of Compromise (IoC)	Description	Example
Phishing Emails	Spear-phishing emails with malicious attachments	Invoice_2023.pdf
CobaltStrike Beacons	Tool used for lateral movement in compromised networks	CobaltStrike.exe
‘.clop’ File Extension	Files encrypted by Clop with this extension	document.txt.clop
Email Stealer Malware	Collects email addresses from compromised systems	example_stealer.exe

.

This table highlights the primary IoCs that can be used to detect Clop ransomware activity within a network. Security teams can use these indicators to enhance monitoring and defense mechanisms. For example, the case where IOC is phishing emails is shown in Figure 1.

4.2. Ransomware Development Tools

• Acquisition of Tools and Malicious Codes: The attacker utilizes commercial malicious tool CobaltStrike (version 4.0 and earlier) for lateral movement within the target network, as shown in Figure 2 [18]. Additionally, for remote control purposes, the attacker uses malicious remote-control software such as Ammyy Admin, AmadeyBot, and TinyMet [19,20]. Most of these malicious codes tend to have characteristics where functionalities of open-source tools are slightly modified for their hacking.
• Malicious Code Creation: The attacker utilizes what appears to be a self-developed malicious tool to exploit Server Message Block (SMB) vulnerabilities for internal propagation [21,22], as illustrated in Figure 3. Figure 3 is significant as it visually represents the logging process that enables researchers to trace the modifications made by Clop ransomware during the delivery and execution of its payload within a compromised network.

4.3. Initial Infiltration

Phishing emails disguised as invoices, shipping bills, and pay slips are sent out, enticing victims to open attached files. Upon opening the malicious document attached to the email, embedded macros are executed, downloading and running an additional malicious file [23]. Before this malicious code downloads additional malware, it checks if the infected system is connected to an AD server (command: net user/domain), and if not, it terminates the process [24]. To infiltrate corporations, individuals are targeted with spear-phishing emails. The phishing tactics used include both adding attachments and embedding malicious links within the email body [25]. Upon opening the malicious document attached to the email, the embedded macros are activated, leading to the download and execution of an additional malicious file, as shown in Figure 4 [26].

To masquerade as a normal program, malicious code is distributed with a digital signature [27]. If antivirus software is running, it refrains from performing malicious actions and terminates, as shown in Figure 5.

4.4. Lateral Movement

When connected to an AD server, the PC downloads and installs malware for remote control, and through this, additionally installs a hacking tool called CobaltStrike [28]. CobaltStrike can perform various malicious activities, one of which is the ability to propagate malware to internal systems through the exploitation of the SMB protocol vulnerability [29].

AD Verification: Before downloading additional files, the malicious code ‘vsupdate.exe’ that is downloaded through macro execution checks whether the infected system is connected to an AD server. As part of this process, the command net user /domain is executed to determine whether the system is part of a domain. The output of this command varies depending on whether the system is connected to a typical workgroup or an AD domain, as shown in Figure 6.

When an internal PC connected to AD is infected, the CobaltStrike hacking tool is used, and using the SMB protocol, files are created, and services are generated to spread malware throughout the internal system [30], as shown in Figure 7.

4.5. Discovery and Collection

Once the malware undergoes the authentication process and successfully connects, it collects and leaks information from the infected device to the C&C [31], as shown in Figure 8 and Figure 9.

Figure 8 is intended to illustrate the specific lines of code used by Clop ransomware to gather and exfiltrate device information to its Command and Control (C&C) server, a critical step in the ransomware’s information-gathering phase.

4.6. Privilege Escalation

During the internal movement, when access to the AD server’s administrator system is achieved, the built-in memory hacking tool ‘Mimikatz’ of CobaltStrike is used to acquire the administrator account, as shown in Figure 10.

To execute actions such as creating, deleting, and running services for the propagation of ransomware on the system when there is a need for elevated administrative privileges, the hacking tool attempts to use the built-in ‘Bypass User Account Control (UAC)’ function to acquire the permissions equivalent to the administrator [32], as shown in Figure 11 and Figure 12. Advanced attack techniques exploiting Security Account Manager (SAM) Hashes and Mimikatz are listed in

Table 2. Advanced Attack Techniques: Exploiting SAM Hashes and Mimikatz.

Term	Description
Bypass UAC	Bypassing the User Account Control (UAC) security feature
Dump Hashes	Extracting password hashes from the SAM database
Golden Ticket	Using the krbtgt ticket’s hash to generate unauthorized Kerberos tickets
Make Token	Creating a new token for unauthorized access
Run Mimikatz	Executing Mimikatz to extract plain-text passwords and other secrets from the OS memory

.

4.7. Ransomware Propagation

In its sequence of malicious operations, the ransomware strategically terminates specific processes, enabling smoother file encryption. It encrypts pivotal files within the compromised system, renaming their extensions to ‘.clop’. Following this action, a ransom note titled ‘ClopReadMe.txt’ is created in the affected folders, providing victims with decryption guidelines. This ransomware further enforces the termination of an extensive list of processes, with a notable emphasis on those associated with database programs [33,34].

5. Indicators of Compromise and Countermeasures against Clop Ransomware

5.1. Countermeasures against Clop Ransomware

The evolution of ransomware has seen it become increasingly advanced, posing significant challenges for mitigation efforts. The decision to halt malicious processes, as depicted in

Table 3. Terminated processes for ransomware activity.

List of Processes to Terminate
zoclove.exe	thebats64.exe	outlook.exe	mspub.exe
mysqld-nt.exe	envoy.exe	wordpad.exe	sqlbrowser.exe
sysTime.exe	ossls.exe	iaglsplus.exe	NTAGMng.exe
agents.exe	thunderbird.exe	powerpnt.exe	mysqldoos.exe
mysqld-opt.exe	excel.exe	visio.exe	sqlservr.exe
thbirdcng.exe	onenote.exe	msoia.exe	NTsansvc.exe
outloowds.exe	visio.exe	sqlbrowser.exe	mydesktop service.exe
thebat.exe	oracle.exe	reflector.exe	sctui.manager.exe
dbsnmp.exe	winword.exe	sglagent.exe	rambntvy.exe
comm.exe	infopath.exe	FMTMon.exe	steam.exe

, is strategic. Each terminated process plays a critical role in the ransomware’s ability to propagate and encrypt files. By proactively monitoring these IoCs, security teams can more effectively identify and neutralize threats before significant damage occurs [35,36].

Applications such as outlook.exe and thunderbird.exe, vital for communication, are disrupted, potentially hindering victims from seeking immediate assistance. By pausing database-oriented processes such as mysqld-nt.exe and sqlservr.exe, the ransomware may be strategizing to encrypt invaluable data, pressuring entities to fulfill ransom demands [37,38]. Interruptions to commonly used software such as wordpad.exe, powerpnt.exe, and excel.exe could severely disrupt organizational operations. Moreover, the cessation of platforms such as steam.exe indicates that the ransomware does not solely target businesses but also individual users, jeopardizing personal files, including game saves [39]. The consequences of this ransomware are manifold. Aside from the immediate encryption threat, interrupted processes can result in data losses, decreased productivity, and potential breaches of confidential data [40]. As victims grapple with the immediate ransom demands, they must also consider the long-term ramifications of interrupted processes and potential data breaches.

It is imperative, therefore, for both organizations and individuals to adopt preventive measures. This includes regular data backups, constant system process monitoring, and employing updated security tools. Equipped knowledge about ransomware’s mode of operation is the first step in mounting a robust defense [41].

Furthermore, upon securing Administrator privileges on the Domain Controller (DC), these permissions facilitate the distribution of ransomware to systems connected to the DC. The ransomware exploits the SMB port (445) to transfer its malicious files onto the target system, subsequently registering them for execution. All compromised files are renamed with the ‘.clop’ extension, and the utilized encryption key is appended at the end of each encrypted file. After encryption, ransom notes are placed in various folders, notifying users of the security breach. The creation of the ‘clearsystem-10-1.bat’ file disables system recovery by deleting volume shadow copies, as demonstrated in Figure 13.

The ransomware script shown in Figure 13 systematically deletes volume shadow copies and resizes shadow storage across different drives, making it difficult for users to restore their data. Commands such as vssadmin delete shadows and vssadmin resize shadowstorage effectively limit the system’s ability to recover from the ransomware attack. Additionally, system recovery options are disabled using the bcdedit commands at the end of the script, further complicating restoration efforts.

As shown in Figure 14, the ransomware sequentially reads the files targeted for encryption and proceeds with the encryption process. The attacker’s public key is embedded within the malicious code. For each file targeted for encryption, a unique encryption key is generated and used. This encryption key is then encrypted using the attacker’s embedded public key and appended at the end of the encrypted file [42].

Figure 15 shows a foundational insight into the encryption process exemplified by a code snippet. It visually conveys how the emphasized encryption mechanism in our research is implemented. Notably, this code specifically addresses the process of generating a unique encryption key for each file [43,44].

Figure 16 visually shows how the attacker’s public key is embedded into the data. Based on our research findings, this method of key insertion plays a pivotal role in the decryption process [45,46].

Figure 17 provides a detailed view of the structure of encrypted data, highlighting the placement of the ‘Clop^’ marker and the encrypted key. The Clop^ marker is particularly significant as it denotes the boundary between the encrypted data and the encrypted key. This structure provides essential insight into the ransomware’s encryption mechanism, helping to better understand its behavior and methodology [47].

Figure 18 shows a flowchart that intricately illustrates the complete infection and propagation procedure of the Clop ransomware. Through this depiction, one can attain a profound understanding of the ransomware’s attack vectors and its operational mechanisms [48].

5.2. Targeted Countermeasures for Clop Ransomware

Clop ransomware’s attack strategies are highly specialized, particularly in their focus on exploiting Active Directory (AD) servers and leveraging vulnerabilities within Windows Server Message Block (SMB) protocols. To effectively defend against Clop, organizations should implement the following targeted countermeasures:

Firstly, since Clop ransomware frequently targets AD servers as a primary entry point, organizations must enforce strict access controls on AD administrator accounts. This includes utilizing multi-factor authentication (MFA) and conducting regular audits to detect unauthorized access attempts. Additionally, implementing tiered administrative models can limit the potential damage if an AD account is compromised, reducing the overall risk to the organization.

Secondly, considering that Clop exploits vulnerabilities in the SMB protocol for lateral movement within networks, it is crucial to regularly audit and patch these protocols. Disabling SMBv1, enforcing the use of SMBv2 or higher, and ensuring that only necessary services are running can significantly reduce the attack surface. Furthermore, network segmentation can help contain the spread of ransomware if an initial breach occurs, preventing the malware from easily moving across the network.

Thirdly, deploying Endpoint Detection and Response (EDR) systems specifically tuned to detect Clop ransomware’s Indicators of Compromise (IoCs) is essential. These systems should be configured to provide real-time alerts and automated responses to suspicious activities, particularly monitoring for the use of known malicious tools such as CobaltStrike and flagging unusual file modifications, such as the renaming of files with the ‘.clop’ extension. This proactive detection can prevent the ransomware from executing its intended damage.

Additionally, organizations should develop a comprehensive incident response plan that includes specific protocols for handling Clop ransomware attacks. Regularly conducting simulated ransomware attacks, such as red teaming exercises, can help identify gaps in the organization’s defense mechanisms and improve overall response time during an actual incident.

Finally, continuous training programs should be implemented to educate employees about the risks of spear phishing and social engineering, which are commonly used to deliver Clop ransomware. Employees should be trained to recognize and report suspicious emails and to follow best practices for email security, thereby reducing the likelihood of initial infiltration.

By implementing these targeted countermeasures, organizations can better protect themselves against the sophisticated tactics employed by Clop ransomware, thereby minimizing the risk of a successful attack and mitigating potential damage.

6. Conclusions

In this paper, the rapidly increasing Clop ransomware attacks targeting the manufacturing, logistics, and distribution sectors were analyzed. Clop ransomware typically employs an Advanced Persistent Threat (APT) attack strategy, wherein it masquerades as a specific organization and sends macros with attached documents or executable files. Once the victim accesses these attachments, the ransomware establishes its initial foothold within the organization.

Upon analyzing the root causes of incidents in companies targeted by Clop ransomware, it became evident that a vulnerable operational environment where the AD administrator account could be easily compromised was the primary reason for the breaches. While the AD server serves as a useful tool for organizational administrators to manage multiple systems, the moment a hacker gains control over the AD server management rights, it creates a crisis where access to all systems connected to the company’s AD server is granted to the hacker. To counteract Clop ransomware, organizations must strengthen access control for the AD administrator account and enhance employees’ ability to respond to hacking emails, such as spear phishing, through mock hacking drills. Additionally, there should be an increased focus on security, such as implementing offline backups for key data and equipment.