So stoppen Sie die Clop Ransomware-Angriffe mit Illumio

The ransomware landscape is a complex, volatile space. Variants come and go, developers borrow and steal from each other, and affiliates add their own bespoke customizations. This can make it difficult to know who or what exactly you’re dealing with when a breach strikes. It can also make two separate attacks from nominally the same collective potentially very different from each other.

Despite all this complexity and change, one permanent over recent years has been the Clop group. It has compromised organizations as diverse as global law firms and aircraft manufacturers, accruing hundreds of millions of dollars in the process.

Fortunately for Illumio customers, we can stop Clop attacks from turning into cyber disasters. It all boils down to understanding how critical network assets communicate with each other and then blocking non-essential connections at scale.

Was hat es mit Clop auf sich?

Clop is one of the wealthiest ransomware groups around. Reports say money launderers connected with the outfit have tried to conceal at least $500 million. The real figure for revenues from ransomware is certain to be way higher. The malware first appeared in 2019, a variant of a previous strain known as CryptoMix. Over the succeeding years, it was set to work targeting sectors as diverse as transportation and logistics, education, manufacturing, healthcare and retail.

Clop has been associated with multiple initial access vectors in the past — from direct phishing attacks to zero-day exploits targeting a single file transfer software provider. The latter technique, highly unusual in the ransomware space, garnered the group global notoriety and many corporate victims.

One common thread linking most of these attacks is that of "double extortion." Now commonplace among ransomware actors, it was popularized by groups like Clop. In such an attack, victim organizations not only find their most sensitive data and systems encrypted, but they might also suffer a serious data breach. It effectively raises the stakes for corporate victims. You might have backups for the encrypted data. But if the bad guys have stolen sensitive IP or highly regulated customer data, that’s going to change any risk calculation significantly.

Wie funktioniert Clop?

While there’s plenty of variation in Clop attacks, one particular pattern is instructive in the modus operandi of affiliates. It exploits misconfigured Active Directory (AD) systems to compromise those AD accounts with domain privileges. This provides attackers with the keys to the kingdom, enabling them to:

• Execute remote commands such as WMI and PowerShell scripts on the compromised endpoint and any other systems connected to it via AD.
• Maintain persistence on a compromised system by creating new accounts, or creating/modifying system processes. Threat actors could also execute commands or initialize scripts automatically on boot up or log on — on any networked asset connected via AD.

With these tools in their arsenal, Clop attackers can move fairly easily through compromised organizations, deploying the ransomware and finding and exfiltrating sensitive data. They must connect to the public internet to do so, in order to download additional tooling and upload the stolen data.

Wie man Clop stoppt

In this scenario, neutralizing the Clop threat requires security teams to gain granular insight into how their AD setup works. By removing domain privilege access from accounts that don’t need it — i.e., enforcing “least privilege” principles — they can reduce the attack surface significantly. Next, restrict the common pathways such an attack might look to exploit, including WinRM, NetBIOS and SMB.

Wie Illumio helfen kann

Illumio helps some of the world’s largest organizations to thwart attacks from Clop and any other ransomware group. We do this by providing streamlined, scalable policy management to help enforce Zero Trust segmentation.

Mit Illumio können Sie in Echtzeit nachvollziehen, wie Netzwerkressourcen miteinander und mit dem öffentlichen Internet kommunizieren. Dann können Sie strategische Entscheidungen darüber treffen, welche Wege offen gehalten und welche blockiert werden sollen – so wird die Angriffsfläche reduziert und den Bösewichten keine gute Wahl gelassen.

Kurz gesagt, Illumio kann helfen, Clop Ransomware zu stoppen, indem es:

• Zuordnen aller Active Directory-Instanzen und -Verbindungen
• Identifizierung wesentlicher eingehender/ausgehender Verbindungen
• Schnelle Bereitstellung von Richtlinien, um nicht wesentliche Kommunikation in großem Umfang einzuschränken und alle offen gelassenen Pfade zu überwachen

Like most groups, Clop is resilient. Just days after a major law enforcement crackdown led to arrests, it was back up and compromising victims. The only way to tackle this kind of persistence is with sophisticated Zero Trust segmentation from Illumio.

Um mehr darüber zu erfahren, wie Illumio zur Eindämmung von Ransomware-Angriffen beiträgt, kontaktieren Sie uns noch heute.