Unpacking the Cl0p Ransomware Technical Details

Technical Analysis of Cl0p Ransomware

Cl0p ransomware, associated with the TA505 threat group, has emerged as a significant and persistent cyber extortion threat since its appearance in 2019. This ransomware family, a variant of CryptoMix, has evolved from traditional file encryption to large-scale data exfiltration and zero-day exploitation, primarily targeting managed file transfer (MFT) solutions. The group employs a "double extortion" tactic, stealing sensitive data before encryption and threatening to publish it on their Tor-based leak site, CL0P^_-LEAKS, if victims refuse to pay the ransom.

What the Vulnerability Is and Its Impact

Cl0p ransomware gained notoriety through its exploitation of critical vulnerabilities in popular MFT platforms. Two prominent examples include CVE-2023-34362 in Progress Software's MOVEit Transfer and CVE-2023-0669 in Fortra's GoAnywhere MFT. These vulnerabilities allowed the Cl0p group to compromise numerous organizations, leading to widespread data breaches. CVE-2023-34362 is a critical SQL injection vulnerability affecting Progress Software's MOVEit Transfer web application. This flaw allows an unauthenticated attacker to gain access to the MOVEit Transfer database. The vulnerability has a CVSS score of 9.8 (Critical). Affected versions include MOVEit Transfer 2023.0.0, 2022.1.x, 2022.0.x, 2021.1.x, 2021.0.x, 2020.1.x, and 2020.0.x. Exploitation of this vulnerability led to the deployment of a web shell named LEMURLOOT, used for data exfiltration. CVE-2023-0669 is a pre-authentication remote code execution (RCE) vulnerability in Fortra GoAnywhere MFT. This critical command injection vulnerability exists in the License Response Servlet and stems from insecure deserialization of attacker-controlled objects, allowing unauthenticated remote attackers to execute arbitrary commands. The vulnerability has a CVSS score of 7.2 (High). It affects Fortra GoAnywhere Managed File Transfer versions prior to 7.1.2. This vulnerability was actively exploited as a zero-day.

Technical Root Cause Analysis

The root cause of CVE-2023-34362 in MOVEit Transfer is an SQL injection flaw. An attacker can craft malicious SQL queries to interact with the underlying database. This allows them to infer information about the database structure, execute arbitrary SQL statements, and potentially alter or delete database elements. The vulnerability specifically enabled the Cl0p group to install a web shell, LEMURLOOT, on internet-facing MOVEit Transfer web applications. This web shell then facilitated data theft from the MOVEit Transfer databases. For CVE-2023-0669 in GoAnywhere MFT, the root cause lies in insecure deserialization within the License Response Servlet. The application improperly handles incoming serialized Java objects. An attacker can craft a malicious serialized object that, when processed by the vulnerable servlet, triggers arbitrary command execution on the underlying system. This vulnerability allowed unauthenticated attackers to achieve RCE on GoAnywhere MFT servers. The attack requires network access to the GoAnywhere MFT administrative console, typically on port 8000 or 8001.

Exploitation Mechanics

The Cl0p ransomware group's exploitation mechanics for these MFT vulnerabilities follow a pattern focused on initial access and data exfiltration. For MOVEit Transfer (CVE-2023-34362), the attackers leveraged the SQL injection to upload the LEMURLOOT web shell. This web shell, typically named `human2.aspx`, masquerades as a legitimate file. Once deployed, LEMURLOOT allows for persistence and enables the attackers to execute operating system commands and steal data from the MOVEit databases. Attackers provide a hard-coded password in the "X-siLock-Comment" header for authentication to the web shell. In the case of GoAnywhere MFT (CVE-2023-0669), Cl0p exploited the insecure deserialization vulnerability to install web shells, providing persistent access and enabling automated data exfiltration. The exploitation involves sending a specially crafted HTTP request containing a malicious serialized Java object to the License Response Servlet endpoint on the administrative interface. The servlet deserializes this object, executing code with the privileges of the GoAnywhere MFT service. This pre-authentication RCE allowed attackers to compromise over 130 organizations without needing valid credentials. Post-exploitation activities often involve using tools like Mimikatz for credential extraction, PsExec, and Cobalt Strike for lateral movement. Cl0p also disables security tools and backup processes to hinder recovery.

Detection

Detecting Cl0p ransomware activity requires a multi-layered approach, focusing on network, endpoint, and application-level monitoring. Organizations should look for specific Indicators of Compromise (IoCs) related to Cl0p's known tactics. These include the presence of web shells like LEMURLOOT (`human2.aspx` or `_human2.aspx`), unusual HTTP POST requests to MFT applications (e.g., to `moveitaspi.dll` or `guestaccess.aspx`), and the `X-siLock` header in MOVEit file transfers. Monitor network traffic for unusual patterns or communication with known command-and-control servers. Implement network intrusion detection capabilities to identify suspicious HTTP POST requests and web shell interactions. Examine MFT application logs and web server logs for unauthorized access attempts, file manipulation, or abnormal process execution. For GoAnywhere MFT, check for suspicious activity on the administrative console, typically accessible on ports 8000 or 8001. Secably offers various tools to help identify potential exposure. Use the free website vulnerability scanner to check for known vulnerabilities in internet-facing applications. The free port scanner can identify open ports, helping determine if MFT administrative interfaces are unintentionally exposed. The DNS lookup tool assists in identifying associated domains and infrastructure. For a broader attack surface view, consider Secably's paid monitoring plans, starting at $19/month. External tools like Zondex can perform internet-wide scanning to identify exposed services. Look for Cl0p's distinct file extensions (`.clop`, `.CIIp`, `.C_L_O_P`) on encrypted files and the presence of ransom notes demanding cryptocurrency. Suspicious privilege escalation, disabled security tools, and deleted shadow copies are also strong indicators. EDR solutions can detect malicious activity, such as the use of `Rundll32` for code execution or specific SHA256 hashes associated with Cl0p payloads. Organizations should audit for active administrative accounts in databases using SQL queries to ensure only legitimate accounts exist.

Remediation Steps

Immediate remediation for Cl0p ransomware incidents involves several critical steps. First, isolate all affected systems and disconnect them from the network. This includes disabling Wi-Fi, unplugging Ethernet, and blocking suspicious IPs at the firewall. Do not attempt self-removal, as this can worsen data loss or trigger further encryption. Apply vendor patches immediately for all identified vulnerabilities. For MOVEit Transfer, update to fixed versions beyond those listed as vulnerable. Progress Software released advisories and patches for CVE-2023-34362. For GoAnywhere MFT, upgrade to version 7.1.2 or later to address CVE-2023-0669. If immediate patching is not possible, disable the License Response Servlet for GoAnywhere MFT and implement network-level access controls to block external access to the administrative interface. Conduct a thorough forensic analysis to determine the breach scope, identify initial access vectors, and trace attacker activity using EDR tools. Preserve all logs, memory, and system snapshots before cleaning. Remove any deployed web shells, backdoors, and persistence mechanisms. Reimage all infected devices from clean, verified backups. Rotate high-risk credentials, including service accounts and MFT administrator credentials. Implement robust security measures to prevent future attacks. This includes regular patching and updates for all software and operating systems. Grant administrative privileges and access only when necessary, and establish a software allow list. Monitor network ports, protocols, and services, activating security configurations on network infrastructure devices. Implement continuous monitoring of third-party vendors' security postures. Regular, offline backups are essential for data restoration without paying a ransom. Educate employees on cybersecurity best practices, including identifying phishing threats.

Timeline of Disclosure

The Cl0p ransomware group has a history of exploiting zero-day vulnerabilities in MFT solutions, often preceding public disclosure. GoAnywhere MFT (CVE-2023-0669):

• January 18, 2023: Fortra (formerly HelpSystems) publishes a private security advisory to GoAnywhere MFT customers regarding an RCE vulnerability requiring administrative console exposure.
• Late January 2023: Cl0p ransomware group begins mass exploitation of CVE-2023-0669 against internet-exposed GoAnywhere MFT instances as a zero-day.
• February 1, 2023: Fortra releases an advisory, initially behind an authentication wall, and provides emergency guidance.
• February 6, 2023: CVE-2023-0669 is published to NVD. A proof of concept is released by security researcher Florian Hauser.
• February 7, 2023: Fortra releases version 7.1.2 of GoAnywhere MFT, which patches the vulnerability.
• February 10, 2023: Cl0p publicly claims credit for exploiting the GoAnywhere zero-day, stating they compromised over 130 organizations.

MOVEit Transfer (CVE-2023-34362):

• May 27, 2023: Earliest evidence of exploitation of CVE-2023-34362 by the Cl0p ransomware group.
• May 31, 2023: Progress Software discloses a critical SQL injection vulnerability in MOVEit Transfer and MOVEit Cloud, publishing an advisory and issuing guidance.
• June 1, 2023: Multiple threat intelligence firms share evidence of active exploits and IoCs. CISA publishes a Security Advisory.
• June 2, 2023: CVE-2023-34362 is assigned with a CVSS score of 9.8. CISA adds this vulnerability to the Known Exploited Vulnerabilities (KEVs) Catalog. Microsoft attributes the attacks to the Lace Tempest group (associated with Cl0p).
• June 5, 2023: Cl0p publishes a statement on their blog regarding the MOVEit campaign.
• June 6, 2023: Cl0p ransomware group claims responsibility for exploiting the MOVEit vulnerability, exfiltrating data from hundreds of organizations.
• June 7, 2023: FBI and CISA release a joint Cybersecurity Advisory detailing known Cl0p ransomware IoCs and TTPs related to the MOVEit exploitation.