The Demon Cl0p, Thief of Transfers

Legend

Linked to the criminal cluster known as TA505/FIN11 and appearing in 2019, since 2020 it has specialised in mass exploitation of zero-days in file-transfer products. With MOVEit, in 2023, it stole data from hundreds of organisations in a few days, often without encrypting anything at all.

Exorcism

Cast it out by exposing no more than necessary to the internet and patching file-transfer software immediately. Monitoring large outbound transfers helps catch the theft in time.

Technical record

Also known as: Clop
Circle: Circle III · Ransomware and extortion
First seen: 2019
Status: Active
Works: The Scourge of MOVEit

Ransomware linked to the financially motivated TA505/FIN11 cluster, first seen in 2019. Since 2020 the group has specialised in mass exploitation of zero-days in file-transfer products, stealing data from hundreds of organisations at once and extorting them, as in the 2023 MOVEit campaign. It remains active.

Sources: attack.mitre.org · attack.mitre.org · cisa.gov · MITRE ATT&CK reference S0611