CLOP Ransomware Gang: 44 Victims Posted in Latest Leak Site Dump — Exploit-Driven Campaign Analysis & Detection Rules

---
title: CLOP Edge Exploitation Follow-On - Webshell and Loader Execution from VPN/Exchange Processes
description: Detects suspicious child processes spawned by Check Point, Exchange, or web server processes — consistent with CLOP post-exploitation webshell activity (DEWMODE/LEMURLOOT lineage) after edge device compromise.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/12
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\UMWorkerProcess.exe'
      - '\httpd.exe'
      - '\nginx.exe'
    ParentImage|contains:
      - 'CheckPoint'
      - 'Exchange'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Exchange cumulative update installers
  - Legitimate Check Point management scripts (rare on gateways)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1505.003
  - attack.t1059
---
title: CLOP Pre-Encryption Data Staging - Bulk Archive Creation with Renamed RAR/7z
description: Detects mass compression activity characteristic of CLOP data staging prior to exfiltration — archive utilities executed from non-standard paths or with obfuscated names, or creating archives in staging directories.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - ' -hp'
      - ' -p'
  selection_path:
    Image|contains:
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\AppData\'
  selection_suspicious_output:
    CommandLine|contains:
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
      - '.zip"
      - '.rar"
  condition: selection_img and selection_cli and (selection_path or selection_suspicious_output)
falsepositives:
  - IT backup scripting (constrain to staging paths to reduce noise)
  - Software packaging teams
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074
---
title: CLOP Lateral Movement via RMM and PsExec-Style Service Execution
description: Detects PsExec-style remote service installation and ScreenConnect/undesired RMM execution consistent with CLOP post-exploitation lateral movement (CVE-2024-1708 ScreenConnect abuse).
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith:
        - '\psexec.exe'
        - '\psexesvc.exe'
        - '\paexec.exe'
    - OriginalFileName:
        - 'PsExec'
        - 'psexesvc.exe'
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\anydesk.exe'
      - '\teamviewer.exe'
  selection_rmm_unsigned_path:
    Image|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
  condition: selection_psexec or (selection_rmm and selection_rmm_unsigned_path)
falsepositives:
  - Sanctioned PsExec administration (allowlist by admin account + source host)
  - Corporate ScreenConnect instances — validate instance ID against your tenant
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1219

// Security Arsenal — CLOP Pre-Ransomware Staging & Lateral Movement Hunt
// Microsoft Sentinel | Lookback: 14d | Run daily during active CLOP campaign windows
// Hunts: edge-device logins from anomalous sources, archive staging, RMM tool drops,
//        suspicious outbound volume (exfil), and shadow copy tampering.

let Lookback = 14d;
let SuspiciousTools = dynamic(["rar.exe","7z.exe","7za.exe","psexec.exe","psexesvc.exe",
  "screenconnect.clientservice.exe","anydesk.exe","certutil.exe","bitsadmin.exe","megasync.exe","rclone.exe"]);

// --- Part 1: New admin logons from unusual sources near VPN/edge events ---
let AnomalousLogons =
  SigninLogs
  | where TimeGenerated > ago(Lookback)
  | where ResultType == 0
  | summarize FirstSeen=min(TimeGenerated), Apps=make_set(AppDisplayName),
      IPs=make_set(IPAddress), Locations=make_set(Location)
    by UserPrincipalName
  | where array_length(IPs) == 1;  // tune: users with single new IP in window

// --- Part 2: Staging & exfil tooling execution ---
let StagingExec =
  DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where FileName has_any (SuspiciousTools)
     or ProcessCommandLine has_any (" -hp", " -p", "rclone copy", "rclone sync", "mega-put")
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256;

// --- Part 3: Volume Shadow Copy deletion (pre-encryption anti-recovery) ---
let VssTamper =
  DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where ProcessCommandLine has_any ("vssadmin delete shadows", "vssadmin Delete Shadows",
        "wmic shadowcopy delete", "bcdedit") 
     or (ProcessCommandLine has "recoveryenabled" and ProcessCommandLine has "no")
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;

// --- Part 4: High-volume outbound transfer from servers (exfil proxy signal) ---
let ExfilVolume =
  DeviceNetworkEvents
  | where TimeGenerated > ago(Lookback)
  | where RemotePort in (443, 22, 21, 990)
  | where RemoteIPType == "Public"
  | summarize TotalConnections=count(), UniqueRemotes=dcount(RemoteIP),
      RemoteIPs=make_set(RemoteIP, 20)
    by DeviceName, InitiatingProcessFileName
  | where TotalConnections > 500  // tune to baseline
  | where InitiatingProcessFileName !in~ ("svchost.exe","msedge.exe","chrome.exe","MsMpEng.exe");

// --- Correlate ---
union withsource=Signal
  (StagingExec | extend Detail=ProcessCommandLine),
  (VssTamper | extend Detail=ProcessCommandLine),
  (ExfilVolume | extend TimeGenerated=now(), AccountName="", FileName=InitiatingProcessFileName,
      Detail=strcat("connections=", TotalConnections))
| sort by TimeGenerated desc

# Security Arsenal — CLOP Rapid Triage & Hardening Script
# Run elevated on suspected hosts / file servers during campaign windows.
# Checks: shadow copy integrity, recent scheduled tasks, RMM presence,
#         suspicious archive staging, and RDP exposure.
# Usage: .	riage-clop.ps1 [-Days 7]

param([int]$Days = 7)
$cutoff = (Get-Date).AddDays(-$Days)
$report = [System.Collections.Generic.List[object]]::new()

function Add-Finding($Category, $Detail, $Severity) {
    $report.Add([pscustomobject]@{Category=$Category; Detail=$Detail; Severity=$Severity})
}

Write-Host "[*] Security Arsenal CLOP triage — $env:COMPUTERNAME — $(Get-Date)`n" -ForegroundColor Cyan

# 1. Volume Shadow Copy integrity (CLOP deletes these pre-encryption)
try {
    $shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction Stop
    if (-not $shadows) { Add-Finding "VSS" "NO shadow copies present — possible anti-recovery tampering" "HIGH" }
    else { Add-Finding "VSS" "$($shadows.Count) shadow copies present (oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate))" "INFO" }
} catch { Add-Finding "VSS" "Unable to enumerate shadow copies: $($_.Exception.Message)" "MEDIUM" }

# 2. Scheduled tasks created in last N days (persistence / detonation triggers)
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft\*' } |
  ForEach-Object { Add-Finding "Persistence" "New scheduled task: $($_.TaskPath)$($_.TaskName) — created $($_.Date)" "HIGH" }

# 3. Unauthorized RMM tooling (ScreenConnect, AnyDesk, TeamViewer, etc.)
$rmmPatterns = 'screenconnect','anydesk','teamviewer','splashtop','atera','ninja','rustdesk'
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue | Where-Object {
    $name = $_.Name; $rmmPatterns | Where-Object { $name -match $_ }
} | ForEach-Object { Add-Finding "RMM" "Installed RMM tool: $($_.Name) — verify against approved software list" "HIGH" }
Get-Process -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.ProcessName; $rmmPatterns | Where-Object { $n -match $_ }
} | ForEach-Object { Add-Finding "RMM" "RUNNING RMM process: $($_.ProcessName) (PID $($_.Id))" "CRITICAL" }

# 4. Recent large archive files in staging locations (pre-exfil signal)
$stagingPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP")
foreach ($p in $stagingPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB } |
      ForEach-Object { Add-Finding "Staging" "Large recent archive: $($_.FullName) ($([math]::Round($_.Length/1MB)) MB, modified $($_.LastWriteTime))" "HIGH" }
}

# 5. RDP exposure & recent RDP logons (EventID 4624 Type 10)
$rdp = Get-CimInstance Win32_TerminalServiceSetting -Namespace root\cimv2\TerminalServices -ErrorAction SilentlyContinue
if ($rdp -and $rdp.AllowTSConnections -eq 1) { Add-Finding "Exposure" "RDP ENABLED — verify NLA, restrict via firewall to VPN subnet only" "MEDIUM" }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+10' } |
  Select-Object -First 20 | ForEach-Object {
    if ($_.Message -match 'Source Network Address:\s+(\S+)') {
        Add-Finding "RDP" "RDP logon from $($Matches[1]) at $($_.TimeCreated)" "MEDIUM" }
}

# 6. Webshell check on Exchange (if applicable)
if (Test-Path "C:\inetpub\wwwroot\aspnet_client") {
    Get-ChildItem "C:\inetpub\wwwroot\aspnet_client" -Recurse -Include *.aspx,*.ashx -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff } |
      ForEach-Object { Add-Finding "Webshell" "Recently modified web file: $($_.FullName) ($($_.LastWriteTime))" "CRITICAL" }
}

# Output
Write-Host "`n=== FINDINGS ===" -ForegroundColor Yellow
$report | Sort-Object @{e={$_.Severity -eq 'CRITICAL'};Descending=$true}, @{e={$_.Severity -eq 'HIGH'};Descending=$true} |
  Format-Table -AutoSize | Out-String -Width 300 | Write-Host
$report | Export-Csv -Path ".\triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
Write-Host "[*] Report saved. Escalate any CRITICAL/HIGH findings to IR immediately." -ForegroundColor Cyan