Recently, a new version of the Cl0p ransomware that targets Linux systems has been discovered. Cl0p has been a very active ransomware family for the past few years, attacking many private and public organizations in various industries. In November 2021, six people were arrested in connection with the Cl0p operation, but the ransomware is still being used in attacks. In August 2022, Cl0p was responsible for hacking a UK water company. Recently, a Linux variant of Cl0p was used in an attack against a university in Colombia. This version of Cl0p is similar to the Windows version, but it has some differences in API calls and other OS-related changes. The ransomware attempts to access root and then encrypts other directories. It targets specific folders and subfolders, encrypting all files in them. After encrypting the files, a ransom note is left on the victim's machine. Fortunately, SentinelOne discovered a flaw in the encryption algorithm, which allowed them to create a free decryptor. They have created a Python script that is available on GitHub to help victims of the Cl0p-ELF variant restore their data. It is likely that more Linux-targeted ransomware campaigns will be seen in the future.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 07 Feb 2023 15:23:03 +0000