GENERAL__2020__Analysis_ReportCLOP_Ransomware.pdf

This report documents the CLOP ransomware campaign linked to the E-Land Group, outlining the attack lifecycle from spearphishing with malicious Office macros to AD compromise, Cobalt Strike beacon deployment, credential dumping, lateral movement, and eventual encryption and potential data leakage via deep-web leaks, with details on certificates, distribution via SYSVOL, and a broad set of IoCs and mitigation guidance.