Clop ransomware targets MAMMUT.COM

12 August 2026 high threat

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Clop ransomware gang claims compromise of MAMMUT.COM with exfiltration of employee and user credentials.

Ransomware.live, a tracking platform for ransomware operator disclosures, reports that the Clop ransomware group has claimed responsibility for compromising MAMMUT.COM. The breach involved exfiltration of credentials belonging to at least one employee and 173 user accounts, along with discovery of one set of third-party employee credentials and 42 items on the victim's external attack surface. The victim organization's DNS records were also enumerated as part of the reconnaissance and attack chain. This appears to be a data exfiltration and encryption attack where Clop operators leveraged compromised credentials to gain initial access and move laterally through the victim's network before deploying ransomware and threatening to publish stolen data if a ransom is not paid.

Mentioned in this report

Threat actors Clop

Malware Clop

Detection guidance

Rclone-Style Bulk Upload to Cloud Storage

ATT&CK T1567.002

Detects rclone execution, including renamed binaries via OriginalFileName or characteristic flags, performing copy/sync/move to a remote, a common ransomware-operator exfiltration pattern to cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Rclone-Style Bulk Upload to Cloud Storage
description: Detects rclone being used to copy, sync or move data to a remote cloud
  storage target, a common data-theft step before ransomware deployment. Matches on
  binary name or original filename plus transfer verbs, or on characteristic bulk-transfer
  flags in case the binary was renamed.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \rclone.exe
  - OriginalFileName: rclone.exe
  selection_verb:
    CommandLine|contains:
    - ' copy '
    - ' sync '
    - ' move '
    - ' copyto '
  selection_flags:
    CommandLine|contains|all:
    - --auto-confirm
    - --transfers
  condition: (selection_img and selection_verb) or selection_flags
falsepositives:
- Administrators using rclone for sanctioned backups to cloud storage
- Developers syncing build artefacts with rclone
level: high
id: f617d4dd-e1a6-5691-92b0-5d18b40e71bf
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w

Ransomware Recovery Inhibition via Shadow Copy or Boot Recovery Tampering

ATT&CK T1486

Detects deletion of volume shadow copies or disabling of Windows recovery options, typically performed immediately before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ransomware Recovery Inhibition via Shadow Copy or Boot Recovery Tampering
description: Detects commands that delete volume shadow copies or disable Windows
  boot recovery, commonly run by ransomware operators before encrypting files to prevent
  restoration.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators deliberately purging shadow copies to reclaim disk
  space
- Imaging or system-prep scripts that reconfigure boot recovery settings
level: high
id: 45719c40-455c-5810-9f00-1f7c3e7f2486
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w

2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs