# Clop ransomware targets MAMMUT.COM

Published: 2026-08-12 · Severity: high
Canonical: https://vorant.io/reports/6131db9d-f883-56b8-9a79-55ac321f7b61/clop-ransomware-targets-mammut-com

> Clop ransomware gang claims compromise of MAMMUT.COM with exfiltration of employee and user credentials.

Ransomware.live, a tracking platform for ransomware operator disclosures, reports that the Clop ransomware group has claimed responsibility for compromising MAMMUT.COM. The breach involved exfiltration of credentials belonging to at least one employee and 173 user accounts, along with discovery of one set of third-party employee credentials and 42 items on the victim's external attack surface. The victim organization's DNS records were also enumerated as part of the reconnaissance and attack chain. This appears to be a data exfiltration and encryption attack where Clop operators leveraged compromised credentials to gain initial access and move laterally through the victim's network before deploying ransomware and threatening to publish stolen data if a ransom is not paid.

## Mentioned in this report

- Threat actors: Clop
- Malware: Clop

## Detection guidance (public sample)

### Rclone-Style Bulk Upload to Cloud Storage

ATT&CK: T1567.002

Detects rclone execution, including renamed binaries via OriginalFileName or characteristic flags, performing copy/sync/move to a remote, a common ransomware-operator exfiltration pattern to cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Rclone-Style Bulk Upload to Cloud Storage
description: Detects rclone being used to copy, sync or move data to a remote cloud
  storage target, a common data-theft step before ransomware deployment. Matches on
  binary name or original filename plus transfer verbs, or on characteristic bulk-transfer
  flags in case the binary was renamed.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \rclone.exe
  - OriginalFileName: rclone.exe
  selection_verb:
    CommandLine|contains:
    - ' copy '
    - ' sync '
    - ' move '
    - ' copyto '
  selection_flags:
    CommandLine|contains|all:
    - --auto-confirm
    - --transfers
  condition: (selection_img and selection_verb) or selection_flags
falsepositives:
- Administrators using rclone for sanctioned backups to cloud storage
- Developers syncing build artefacts with rclone
level: high
id: f617d4dd-e1a6-5691-92b0-5d18b40e71bf
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w
```

### Ransomware Recovery Inhibition via Shadow Copy or Boot Recovery Tampering

ATT&CK: T1486

Detects deletion of volume shadow copies or disabling of Windows recovery options, typically performed immediately before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ransomware Recovery Inhibition via Shadow Copy or Boot Recovery Tampering
description: Detects commands that delete volume shadow copies or disable Windows
  boot recovery, commonly run by ransomware operators before encrypting files to prevent
  restoration.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators deliberately purging shadow copies to reclaim disk
  space
- Imaging or system-prep scripts that reconfigure boot recovery settings
level: high
id: 45719c40-455c-5810-9f00-1f7c3e7f2486
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/TUFNTVVULkNPTUBjbG9w

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6131db9d-f883-56b8-9a79-55ac321f7b61/clop-ransomware-targets-mammut-com.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup