MITRE ATT&CK G0088
Aliases: TA505, FIN11, Lace Tempest
Official Attribution Source: CISA Advisory AA23-158A (MOVEit Campaign)
Key Facts
Jurisdiction
Russian Federation
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G0088 (CL0P).
- Linked to 1 primary court prosecution record(s) with $1.2 billion documented loss.
- Identified 0 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1190 Exploit Public-Facing Application | 1 incidents |
| T1505.003 Web Shell | 1 incidents |
| T1567.002 Exfiltration to Cloud Storage | 1 incidents |
Prosecution Cases Attributed to CL0P
MOVEit Transfer Mass Zero-Day Extortion Campaign
investigation 2023-05-31
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
Primary Attack Mechanism: Pre-authenticated SQL injection vulnerability (CVE-2023-34362) in the web application interface of Progress Software MOVEit Transfer managed file transfer servers, allowing remote database access and arbitrary code execution.
3 techniques mapped · Loss: $1.2 billion
View full case dossier →
Documented TTP Signature for CL0P
Test Controls in Stack Audit →T1190: Exploit Public-Facing Application
Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.
T1505.003: Web Shell
Adversaries write malicious server-side scripts onto public-facing web servers or file transfer appliances to preserve command execution access.
T1567.002: Exfiltration to Cloud Storage
Adversaries transfer exfiltrated victim archives directly to external commercial cloud object storage or synchronization providers such as MEGA or Rclone.