Hunt / clop
Cl0p
48victims, 90d
Oct 21last post
0reports about them
16/17techniques with a rule
0indicators
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-10-21 | LEGAL-RECORDS.US | US |
| 2026-09-10 | HENRYPRATT.COM | US |
| 2026-09-10 | HARLEY-DAVIDSON.COM | US |
| 2026-08-14 | ZEBRA.COM | US |
| 2026-08-12 | AOL.COM | US |
| 2026-08-12 | GATE7LLC.COMGBBEV.COM | GB |
| 2026-08-12 | ENTERATEK.MXESBERBEVERAGE.COM | MX |
| 2026-08-12 | NUVITIA.COM | ES |
| 2026-08-12 | IPMSOLUTIONS.SK | SK |
| 2026-08-12 | ECCELLENT.COM | IT |
| 2026-08-12 | STNET.IT | IT |
| 2026-08-12 | QCPL.IN | IN |
Latest 12 of 48, from ransomware.live. These are the group's claims.
What they do
17 techniques, in kill-chain order. 1 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.
| ID | Technique | SigmaHQ | Status |
|---|---|---|---|
| T1059.003 | Windows Command Shell | 46 | SigmaHQ |
| T1106 | Native API | 14 | SigmaHQ |
| T1112 | Modify Registry | 94 | SigmaHQ |
| T1057 | Process Discovery | 8 | SigmaHQ |
| T1083 | File and Directory Discovery | 24 | SigmaHQ |
| T1135 | Network Share Discovery | 7 | SigmaHQ |
| T1497.003 | Time Based Checks | nothing | |
| T1518.001 | Security Software Discovery | 8 | SigmaHQ |
| T1614.001 | System Language Discovery | 2 | SigmaHQ |
| T1486 | Data Encrypted for Impact | 16 | SigmaHQ |
| T1489 | Service Stop | 20 | SigmaHQ |
| T1490 | Inhibit System Recovery | 27 | SigmaHQ |
| T1027.002 | Software Packing | 1 | SigmaHQ |
| T1140 | Deobfuscate/Decode Files or Information | 18 | SigmaHQ |
| T1218.007 | Msiexec | 10 | SigmaHQ |
| T1553.002 | Code Signing | 1 | SigmaHQ |
| T1685 | Disable or Modify Tools | 162 | SigmaHQ |
SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.
Sweep
No indicators. Either nobody has published any for Cl0p, or the reports cite values without marking them as IOCs. package.json