Clop Ransomware Removal & Security Guide

Clop is a ransomware family that encrypts files and adds the .clop extension to them, e.g. photo1.jpg is renamed photo1.jpg.clop. It was discovered in 2019 and has been targeting businesses and organizations worldwide since then. Clop is the successor of the CryptoMix ransomware, which is believed to be a Russian hacker group. Recently, variants are also using the name Cl0p, with the number 0 instead of the letter “o”. Although the different ways of writing, they are the same ransomware.

The Clop ransomware also leaves a ransom letter in every folder on the computer. The letter demands payment in Bitcoins, Ethereum, Monero, or another cryptocurrency.

What kind of malware is Clop?

Clop is ransomware, a type of malware that encrypts and locks the victims’ files and then requests a ransom in exchange for the decryption key. This is a Ransomware as a Service (RaaS) type of malware. This means that cyber attackers groups, known as affiliates, use Clop encryption software and then pay for the ransomware developers.

Since Clop uses symmetric or asymmetric cryptography, recovering the files without a backup is extremely hard. But not impossible. SalvageData ransomware recovery experts can work with your data and securely restore it.

Everything we know about Clop ransomware

Confirmed Name

• Clop virus

Threat Type

• Ransomware
• Crypto Virus
• Files locker

Encrypted Files Extension

• .clop
• .CIop (with a capital i)
• .CIIp
• .Cllp
• .C_L_O_P

Ransom Demanding Message

• ClopReadMe.txt
• README_README.txt
• Cl0pReadMe.txt
• READ_ME_!!!.TXT

Is There a Free Decryptor Available?

• There’s a decryption tool for the Linux variant.

Does the decryptor work?

The clop ransomware variant for Linux is a flawed algorithm, which makes it possible for victims to decrypt the files without paying the ransom. Windows victims can contact ransomware recovery services for decryption. And if the files are corrupted, these services can also help to fix them.

Detection Names

• Avast Win32:RansomX-gen [Ransom]
• AVG Win32:RansomX-gen [Ransom]
• Emsisoft Trojan.GenericKD.64578249 (B)
• Kaspersky HEUR:Trojan-Ransom.Win32.KlopRansom.g
• Malwarebytes Ransom.FileCryptor
• Microsoft Ransom: Win32/HydraCrypt!MTB

Symptoms

• Can’t open files stored on the computer
• Ransom demand letter on the desktop and every folder
• Files have a new extension (e.g. filename1.clop)
• A note with instructions pops up when the victim tries to open an encrypted file

Ransomware family, type & variant

• Clop is a variant of CryptoMix ransomware.
• It is a ransomware family.
• It can have variants such as Clop and Cl0p (with the number 0)

Distribution methods

• Infected email attachments (phishing emails)
• Torrent websites (infected links or files)
• Malicious ads (malvertising)

Consequences

• Files are encrypted and locked until the ransom payment
• Password stealing
• Additional malware can be installed
• Data leak

Prevention

• Antivirus and anti-malware
• Updated software
• Updated operating system (OS)
• Firewalls
• Don’t open an email attachment from an unknown source
• Do not download files from suspicious websites
• Don’t click on ads unless you’re sure it’s safe
• Only access websites from trustworthy sources

How did Clop infect your computer

Clop ransomware finds its way into your computer or network through many methods:

• Spam email campaigns. This a phishing email attack where hackers use social engineering to deceive victims into clicking malicious links or attachments. After that, the exploit kit is downloaded into the machine and ransomware can be triggered at any moment by the threat actors. These emails can be targeted when hackers intend to access a specific business or can be non-targeted phishing when they send a mass malware spam campaign.

• Unofficial software download sources and cracks. Pirate software and crack usually are malicious programs. Also, this software will not have the updates necessary to improve the program and prevent vulnerabilities that hackers can exploit.

• Trojans. A trojan is software that promises to perform one task but executes a different one, mostly malicious. They take the form of fake programs, attachments, and other types of files, deceiving victims.

• Vulnerable remote service. One more way Clop ransomware attacks happen is through unsecured external remote services. Attackers will exploit Remote Desktop Protocol (RDP) tools whose credentials are known, reused, weak, or rephrased to gain access to businesses’ networks and leak data.

• Known software vulnerabilities. Hackers use software with known vulnerabilities to attack businesses as well. That’s why it’s very important to also keep every software updated and protect remote administration tools like RDP.

Clop ransom note

The Clop ransom note will be on every folder on your computer and the desktop as a text file.

This is a sample of the ransom note:

Important: In March 2020 Clop developers created a website, hosted on the dark web, to expose the data from those that didn’t pay the ransom. But don’t be intimidated. Contact authorities and help with a criminal investigation by collaborating with digital forensics.

How does Clop work

Clop ransomware attacks Windows defenses and attempts to disable Windows Defender and remove the Microsoft Security Essentials. That’s why keeping Windows OS updated is also very important for cybersecurity. New updates can have improved protection layers against ransomware such as Clop.

Also, Clop ransomware targets businesses and enterprises aiming for their financial records, emails, and even backups. So, always keep at least one updated backup offline to prevent having the data stolen by cybercriminals.

1. Initial Access

Clop gets into a computer via spam email attachments, trojans, hyperlinks, cracks, unprotected Remote Desktop Protocol (RDP) connections, infected websites, and more. It then scans the device looking for vulnerabilities within the network.

2. Lateral Movement, Discovery, and Defense Evasion

After that, the ransomware will spread across the network via lateral movement. During this phase, Clop actors gather information, escalate privileges, and move laterally in the network.

Clop installs other malware on the compromised machine and also scans it to check if it’s a corporate computer or an individual. If it’s a personal computer, the malware will stop malicious behavior and delete itself. However, if it’s an enterprise machine, it installs the Cobalt Strike hacking tool.

3. Exfiltration

Hackers will then look for classified, critical, and sensitive data and exfiltrate them. Later, they demand payment to not leak this information.

4. Impact

Besides encrypting your files and the threat of leaking the data, Clop developers also designed the ransomware to create a folder with more malicious files for further attacks.

Contacting a ransomware removal service can not only restore your files but also remove potential new Clop threats.

How to handle a Clop ransomware attack

The first step to recover from the Clop attack is to isolate the infected computer by disconnecting from the internet and removing any connected device. Then, you must contact local authorities. In the case of US residents and businesses, it is the local FBI field office and the Internet Crime Complaint Centre (IC3).

To report a ransomware attack you must gather every information you can about it, including:

• Screenshots of the ransom note
• Communications with Clop actors (if you have them)
• A sample of an encrypted file

You must not delete the ransomware, and keep every evidence of the attack. That’s important for digital forensics so experts can trace back to the hacker group and identify them. It is by using the data on your infected system that authorities can investigate the attack and find the responsible. A cyber attack investigation is not different from any other criminal investigation: it needs evidence to find the attackers.

After isolating the device and contacting authorities, you must follow the next steps to retrieve your data:

1. Contact your Incident Response provider

A Cyber Incident Response is the process of responding to and managing a cybersecurity incident. An Incident Response Retainer is a service agreement with a cybersecurity provider that allows organizations to get external help with cybersecurity incidents. It provides organizations with a structured form of expertise and support through a security partner, enabling them to respond quickly and effectively in the event of a cyber incident.

An incident response retainer offers peace of mind to organizations, offering expert support before and in the aftermath of a cybersecurity incident. The specific nature and structure of an incident response retainer will vary according to the provider and the organization’s requirements. A good incident response retainer should be robust but flexible, providing proven services to enhance an organization’s long-term security posture.

2. Identify the ransomware infection

You can identify which ransomware infected your machine by the file extension (some ransomware uses the file extension as their name), or it will be on the ransom note. With this information, you can look for a public decryption key. In the case of the Clop ransomware, Linux-based systems have a decryptor.

You can also check the ransomware type by its IOCs. Indicators of Compromise (IOCs) are digital clues that cybersecurity professionals use to identify system compromises and malicious activities within a network or IT environment. They are essentially digital versions of evidence left at a crime scene, and potential IOCs include unusual network traffic, privileged user logins from foreign countries, strange DNS requests, system file changes, and more. When an IOC is detected, security teams evaluate possible threats or validate its authenticity. IOCs also provide evidence of what an attacker had access to if they did infiltrate the network.

Clop ransomware IOCs

• 9d59ee5fc7898493b855b0673d11c886882c5c1d
• f4492b2df9176514a41067140749a54a1cfc3c49
• 2950a3fcdd4e52e2b9469a33eee1012ef58e72b6
• 37a62c93ba0971ed7f77f5842d8c9b8a4475866c
• a71c9c0ca01a163ea6c0b1544d0833b57a0adcb4
• 21bdec0a974ae0f811e056ce8c7e237fd7c220c1
• 0a7ab8cc60b04e66be11eb41672991482b9c0656
• ec2a3e9e9e472488b7540227448c1794ee7a5be6
• e473e5b82ce65cb58fde4956ae529453eb0ec24f
• 3c8e60ce5ff0cb21be39d1176d1056f9ef9438fa
• d613f01ed5cb636feeb5d6b6843cb1686b7b7980
• c41749901740d032b8cff0e397f6c3e26d05df76
• e38bca5d39d1cfbfbcac23949700fe24a6aa5d89
• 09b4c74c0cf18533c8c5022e059b4ce289066830
• 37269b8d4115f0bdef96483b1de4593b95119b93
• 4d885d757d00e8abf8c4993bc49886d12c250c44
• bc59ff12f71e9c8234c5e335d48f308207f6accfad3e953f447e7de1504e57af
• 31829479fa5b094ca3cfd0222e61295fff4821b778e5a7bd228b0c31f8a3cc44
• 35b0b54d13f50571239732421818c682fbe83075a4a961b20a7570610348aecc
• e48900dc697582db4655569bb844602ced3ad2b10b507223912048f1f3039ac6
• 00e815ade8f3ad89a7726da8edd168df13f96ccb6c3daaf995aa9428bfb9ecf1
• 408af0af7419f67d396f754f01d4757ea89355ad19f71942f8d44c0d5515eec8
• 0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
• 7ada1228c791de703e2a51b1498bc955f14433f65d33342753fdb81bb35e5886
• 8e1bbe4cedeb7c334fe780ab3fb589fe30ed976153618ac3402a5edff1b17d64
• d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9
• cff818453138dcd8238f87b33a84e1bc1d560dea80c8d2412e1eb3f7242b27da
• 929b7bf174638ff8cb158f4e00bc41ed69f1d2afd41ea3c9ee3b0c7dacdfa238
• 102010727c6fbcd9da02d04ede1a8521ba2355d32da849226e96ef052c080b56
• 7e91ff12d3f26982473c38a3ae99bfaf0b2966e85046ebed09709b6af797ef66
• e19d8919f4cb6c1ef8c7f3929d41e8a1a780132cb10f8b80698c8498028d16eb
• 3ee9b22827cb259f3d69ab974c632cefde71c61b4a9505cec06823076a2f898e
• b207ce32398e8816ed44ea079904dc36
• 73efd5dc218db4d8c36546d9c9efe91c
• 36fe53674c67310af572daedf6e8deed
• 96caf3bcd58d41d23d1a4e27f2165ae3
• 7c90d8aed3efb9f8c661b1ab0a6f5986

3. Remove the ransomware and eliminate exploit kits

Before recovering your data, you must guarantee that your device is ransomware-free and that the attackers can’t make a new attack through exploit kits or other vulnerabilities. A ransomware removal service can delete the ransomware, create a forensics document for investigation, eliminate vulnerabilities, and recover your data.

4. Use a backup to restore the data

Backups are the most efficient way to recover data. Make sure to keep daily or weekly backups, depending on your data usage.

5. Contact a ransomware recovery service

If you don’t have a backup or need help removing the ransomware and eliminating vulnerabilities, you should contact a data recovery service. Paying the ransom does not guarantee your data will be returned to you. The only guaranteed way you can restore every file is if you have a backup of it. If you don’t have a recent backup, ransomware data recovery services can help you decrypt and recover the files.

SalvageData experts can safely restore your files and guarantee Clop ransomware does not attack your network again.

Contact our experts 24/7 for emergency recovery service or find a recovery center near you.

Prevent Clop ransomware attack

Preventing ransomware attacks is easier and cheaper than recovering from them. Clop ransomware can cost your business’s future and even close its doors.

The Clop gang targets US hospitals to steal 1 million patients’ data and exploit vulnerabilities known as zero-day. These are software breaches that developers correct through new updates. According to HHS, in 2022 more than 289 hospitals were victims of Clop.

This means you must keep updated software to protect your data against Clop ransomware. However, cybercriminals can be faster sometimes and reach victims before an update is released.

1. Use strong passwords

Make sure each account has its password created randomly with a mix of numbers, letters, and special characters to prevent unauthorized access.

2. Keep software updated

As mentioned before, software updates can close vulnerabilities that cyberattackers can exploit to enter your business network. Keeping software updated will increase your system security.

3. Schedule regular backups

Backups are the most efficient way to restore your data, no matter if you lost it due to a natural disaster or cyberattack. They are also the fastest method to get back to work after a disaster such as a Clop attack.

4. Use a cybersecurity solution

Hiring a cyber security service or having an IT team to keep your data safe will prevent cyber attackers from accessing your data. These professionals can scan your system for vulnerabilities and create measures to improve your business cybersecurity protocols and awareness.

5. Have a recovery plan in hand

A data recovery plan (DRP) is a document that sets strategies on how to handle disasters such as ransomware attacks. They allow faster recovery and business continuity.

See how to create a data recovery plan with our in-depth guide.