Half of EDR Tools, Organizations Vulnerable to Clop Ransomware: Researchers

By Maine Basan

Nearly half of EDR tools and organizations are vulnerable to Clop ransomware gang tactics, according to tests by a cybersecurity company.

Cymulate ran 3,107 assessments across 340 organizations recently to see if security controls were adequate against the Clop (sometimes called “Cl0p” with a zero) ransomware group’s exploitation of a MOVEit software vulnerability (CVE-2023-34362).

The continuous threat exposure management (CTEM) vendor tested to see if organizational controls would recognize the Indicators of Compromise (IoCs) of Clop ransomware attacks. What they found was alarming:

• Out of 14,438 payloads sent, 43% of organizations in the U.S. were penetrated by Cymulate’s Clop ransomware assessments
• Half of the endpoint detection and response (EDR) tools tested — 8 out of 16 tools — had a penetration rate of over 46%

Mike DeNapoli, Cybersecurity Architect and Director at Cymulate, told eSecurity Planet, “While the EDRs could possibly recognize the behavior of the attack if it was executed, which Cymulate can do in other modules, they did not recognize the known binaries used in the attacks. So … the EDR missed an indicator of compromise, and while it may have compensated for it later, the firewall should have stopped inbound/outbound traffic but failed to do so.”

Organizations can still be protected even if their EDR technologies only identify attack patterns rather than individual files, he said.

“The MOVEit vulnerability is shining a new light on exposure management because if the organization has an EDR tool that looks for the behaviors of these attacks but not the files themselves, then they’re still protected,” DeNapoli said.

He added, “If the organization does not have any of the software platforms targeted by these attacks, like the MOVEit platform, then they are also safe even if they didn’t block the indicators of compromise — the attackers don’t have anything to leverage in order for the attack to work in the first place.”

Clop, Others Continue MOVEit Attacks

The Clop ransomware gang’s exploitation of a vulnerability in Progress Software’s MOVEit managed file transfer (MFT) system has hit dozens of major organizations so far, among them.

Abbie, Aer Lingus, the BBC, British Airways, the California Public Employees’ Retirement System, Johns Hopkins University, New York City public schools, Schneider Electric, Shell, Siemens, UCLA, the University of Rochester, the U.S. Department of Energy, and the U.S. Department of Health and Human Services, among others.

However, instead of the typical ransomware tactics, Clop aka Lace Tempest has used the SQL injection vulnerability to steal sensitive data and threaten to release it unless a ransom is paid.

The U.S. Government has offered a $10 million reward for information on the threat actors.

Cybersecurity experts have discovered extensive use of the zero-day vulnerability in MOVEit Transfer. Multiple threat actors — many of whom overlap or are used interchangeably — have been linked to the vulnerability, including FIN11, TA505, and Lace Tempest. While FIN11 and TA505 have been used interchangeably in the past, Mandiant classifies FIN11 as a subset of activity inside the TA505 group. Additionally, Lace Tempest, which runs the Clop extortion site, is also affiliated with FIN11.

“Lace Tempest (Storm-0950, overlaps w/ FIN11, TA505) authenticates as the user with the highest privileges to exfiltrate files,” Microsoft notes.

The cybercriminals started exploiting the vulnerability on May 27th, during the U.S. Memorial Day holiday. Lace Tempest has a track record of exploiting different zero-day vulnerabilities to steal data and extort victims.

TA505 is well-known for its involvement in global phishing and malware dissemination. Their victims include hundreds of companies worldwide, and they engage in various illegal activities, including providing ransomware-as-a-service, acting as an initial access broker, and orchestrating large-scale phishing assaults and financial fraud. This recent exploitation expands their repertoire, highlighting their ability to hack and steal critical data through the MOVEit Transfer web applications with the LEMURLOOT web shell.

Another significant threat actor, FIN11, has been involved in a number of high-profile infiltration efforts that leverages zero-day vulnerabilities. The group has targeted pharmaceutical companies and other healthcare institutions during the COVID-19 pandemic. Their activities primarily target corporations in various industries in North America and Europe, with the goal of stealing data and deploying ransomware using Clop.

The Clop gang’s exploitation of the MOVEit vulnerability has become a critical issue, causing concerns among several organizations about their own security procedures as well as their vulnerability to similar cyber assaults.