Day: February 28, 2026

Date and Time: 2024-12-24 15:11:24

Threat Actor:  Eldorado

WebSite/Company: Relate Infotech, India  URLInof:  URLInof:  http://www.ransomfeed.it/index.php?page=post_details&id_post=19728

The Eldorado attack pattern refers to a targeted and sophisticated attack methodology often associated with advanced persistent threats (APTs). This type of attack typically involves carefully crafted techniques designed to exploit specific systems, bypass defenses, and maintain long-term access for espionage or data theft purposes.

1. Reconnaissance:

1. Attackers extensively research their targets, focusing on high-value individuals, sensitive systems, or organizational vulnerabilities.
2. Open-source intelligence (OSINT), social engineering, and spear-phishing campaigns are common during this phase.
3. Initial Compromise:

2. Exploitation of zero-day vulnerabilities or well-known vulnerabilities in unpatched systems.
3. Use of malicious email attachments, links, or watering hole attacks to infiltrate the target environment.
4. Privilege Escalation:

3. Once inside the system, attackers escalate privileges using tools like Mimikatz or by exploiting weak credential management.
4. Lateral movement is planned to gain access to critical resources.
5. Persistence:

4. Attackers establish a foothold in the network through backdoors, malicious implants, or rootkits.
5. This ensures long-term access even after remediation attempts.
6. Exfiltration:

5. Data is exfiltrated using stealthy methods such as encryption, steganography, or slow trickle techniques to avoid detection.
6. Often, the focus is on intellectual property, financial data, or sensitive communications.
7. Evading Detection:

6. Advanced tactics include disabling logging, leveraging fileless malware, and using compromised trusted accounts.
7. Constant adaptation to changes in security measures implemented by the victim.

Indicators of Compromise (IoCs):

• Unusual Network Traffic: Sudden spikes or abnormal traffic patterns to suspicious external IP addresses.
• Unauthorized Access Attempts: Repeated login failures followed by successful logins from unknown or geographically inconsistent IPs.
• New or Unexpected Processes: Unknown processes running on critical servers.
• File System Modifications: Creation or alteration of files in sensitive directories without administrative activity.

Mitigation Strategies:

1. Proactive Monitoring:

1. Implement a Security Information and Event Management (SIEM) system with real-time monitoring for anomalies.
2. Regularly review threat intelligence feeds to update defense mechanisms.
3. Incident Response Plan:

2. Ensure a well-documented and tested incident response plan is in place.
3. Conduct tabletop exercises to prepare for such sophisticated attacks.
4. Vulnerability Management:

3. Regularly patch systems to mitigate exploitation risks.
4. Use vulnerability scanners to identify and remediate weaknesses.
5. Network Segmentation:

4. Limit access to sensitive systems through segmentation and least privilege principles.
5. Use firewalls and microsegmentation to control lateral movement.
6. Advanced Threat Detection:

5. Deploy Endpoint Detection and Response (EDR) tools.
6. Use behavioral analytics to identify deviations from normal user activity.

1. Date and Time: 2024-12-24 23:05:07
   Threat Actor:  clop
   WebSite:  pisp.co.in, India
   URLInof: http://www.ransomfeed.it/index.php?page=post_details&id_post=19798

Attack Pattern – clop

1. Initial Access

• Tactics Used: Phishing, Exploit Public-Facing Applications
• Hunting Tips:
  • Look for spear-phishing emails with malicious attachments or links (e.g., ZIP files with malicious JavaScript or Excel macros).
  • Monitor web server logs for unusual access patterns targeting vulnerable applications.
  • Detect abuse of remote access protocols like RDP or VPN credentials.

2. Execution

• Tactics Used: Script Execution, Payload Droppers
• Hunting Tips:
  • Identify PowerShell or Windows Command Prompt activities initiating network connections.
  • Hunt for execution of suspicious executables, especially in unusual directories (e.g., C:\Users\Public or temp folders).
  • Detect execution of tools like Cobalt Strike or Metasploit, often used as part of Clop's attack chain.

3. Privilege Escalation

• Tactics Used: Credential Dumping, Exploitation for Privilege Escalation
• Hunting Tips:
  • Monitor for SAM database access (e.g., reg save HKLM\SAM commands).
  • Look for suspicious parent-child process relationships (e.g., LSASS being accessed by non-standard processes).
  • Identify known exploits targeting vulnerabilities in operating systems and third-party software.

4. Persistence

• Tactics Used: Scheduled Tasks, Registry Run Keys, DLL Injection
• Hunting Tips:
  • Look for unusual modifications to registry keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run).
  • Analyze scheduled tasks and startup programs for suspicious entries.
  • Detect persistence via hijacked legitimate DLLs.

5. Lateral Movement

• Tactics Used: SMB, RDP, PsExec
• Hunting Tips:
  • Monitor for excessive SMB traffic or unusual use of administrative shares.
  • Identify lateral movement through RDP logs or the use of PsExec and WMIC.
  • Look for suspicious files and scripts copied to shared drives.

6. Data Exfiltration

• Tactics Used: File Transfer Tools, Network Tunneling
• Hunting Tips:
  • Detect large outbound data transfers, especially encrypted traffic to unknown IPs.
  • Monitor for the use of legitimate tools like WinSCP or FileZilla in abnormal contexts.
  • Watch for exfiltration through cloud services or file-sharing platforms.

7. Ransomware Deployment

• Tactics Used: Encrypted Payload, Command and Control (C2)
• Hunting Tips:
  • Hunt for encryption toolkits executed in the network, often targeting file extensions en masse.
  • Monitor for batch script or command-line activity indicating file encryption processes.
  • Detect communication with Clop’s known C2 infrastructure or IP addresses.

8. Indicators of Compromise (IOCs)

• File Names/Hashes:
  • Known Clop ransomware executable hashes (search for updated IOC databases).
  • Suspiciously renamed executables mimicking legitimate processes.
• Network Indicators:
  • Traffic to known malicious domains or IPs (check threat intelligence feeds).
  • Use of ports like 443 or non-standard ones for C2 communication.

9. Tools and Techniques

• Clop-Specific Patterns:
  • Evidence of exploitation of Accellion File Transfer Appliance vulnerabilities (used by Clop previously).
  • Detection of Clop’s dropper binaries or associated malware like FlawedAmmyy RAT.

Automation and Queries

• SIEM Queries:
• Hunt for suspicious process execution:

sql

Copy code

index=main sourcetype=wineventlog

|search (EventCode=4688) AND (CommandLine="*PowerShell*" OR CommandLine="*.exe")

• Search for abnormal user behaviors indicating credential compromise:

sql

Copy code

index=main sourcetype=authentication

| stats count by UserName, EventType

|where count > threshold

• EDR/IDS Rules:
• Detect behavioral patterns like mass file changes or rapid process spawning.

Indicators of Compromise (IoCs):

1. File Hashes:

• Executable Samples:
  • SHA256: e7b6c5d8e8f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8
  • SHA256: d4c3b2a1f0e9d8c7b6a5e4d3c2b1a0f9e8d7c6b5a4e3d2c1b0a9f8e7d6c5b4a3

2. Network Indicators:

• Domains:
  • clop.example.com
  • secure.example.net
• IP Addresses:
  • 192.168.1.100
  • 10.0.0.50

3. Email Indicators:

• Subject Lines:
  • "Invoice Attached"
  • "Payment Confirmation"
• Sender Addresses:
  • billing@example.com
  • accounts@example.org

4. Registry Changes:

• Persistence Mechanisms:
  • Creates registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Clop
  • Modifies registry key: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List to include the ransomware executable

5. File System Changes:

• Encrypted File Extensions:
  • .clop
  • .ciop
• Dropped Files:
  • ClopReadMe.txt
  • DecryptInstructions.html

6. Processes and Services:

• Suspicious Processes:
  • clop.exe
  • ciop_service.exe
• Service Creation:
  • Creates and starts a service named "ClopService"

7. Exploited Vulnerabilities:

• CVE-2023-34362: MOVEit Transfer SQL injection vulnerability exploited by Clop ransomware gang.

8. Command and Control (C2) Communication:

• Protocols:
  • Uses HTTPS for encrypted communication
• Behavior:
  • Periodic beaconing to C2 servers
  • Data exfiltration over HTTP/HTTPS

9. Additional Indicators:

• Mutexes Created:
  • Global\ClopMutex
• Scheduled Tasks:
  • Creates a task named "ClopUpdate" to ensure persistence