Threat video1:00
Cl0p Windchill, SonicWall SMA Zero-Days: Detection & IOCs
Cl0p is exploiting PTC Windchill while UTA0533 exploits SonicWall SMA 1000 zero-days: 9 detection rules, 32 IOCs and a free Splunk SPL rule.
Read the full threat intel for Cl0p Windchill, SonicWall SMA Zero-Days: Detection & IOCs →
Chapters
- 0:00The hookA 9.8 flaw, reportedly Cl0p's.
- 0:04The storyExtortion emails hit hundreds of users.
- 0:11Attack pathPer reports, recon then a deserialization flaw.
- 0:25AttributionAttributed to Cl0p.
- 0:29Indicators of compromise32 indicators to hunt: 18 IPs, 2 domains and 7 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Apply PTC fixes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A 9.8 flaw, reportedly Cl0p's.
0:05Extortion emails hit hundreds of users.
0:08Manufacturing, automotive, aerospace.
0:12Per reports, recon then a deserialization flaw.
0:15Hex-named webshells added persistence.
0:18Design files staged for double extortion.
0:21Then extortion emails followed.
0:25Attributed to Cl0p. Confidence: medium.
0:3032 indicators to hunt: 18 IPs, 2 domains and 7 SHA-256 hashes, and more.
0:3919 ATT&CK techniques, from initial access to impact.
0:444 steps now: Apply PTC fixes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.