Clop Ransomware Gang Admits to Cleo Data Breach Attacks

December 15, 2024

The Clop ransomware group has publicly confirmed its involvement in recent data-theft attacks on Cleo, a company that develops managed file transfer platforms. They used zero-day vulnerabilities to infiltrate corporate systems and exfiltrate data. Cleo, which develops platforms like Cleo Harmony, VLTrader, and LexiCom for secure file exchanges between businesses and customers, patched a vulnerability (CVE-2024-50623) in October that permitted unrestricted file uploads and downloads, leading to potential remote code execution. However, cybersecurity company Huntress found last week that the initial patch was not wholly effective and threat actors were exploiting a bypass to carry out data theft attacks.

The threat actors exploited the vulnerability to upload a JAVA backdoor, facilitating data theft, command execution, and further access to the compromised network. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that the critical CVE-2024-50623 vulnerability in Cleo's software has been utilized in ransomware attacks. However, Cleo did not publicly disclose that the original flaw they attempted to fix was exploited.

While it was initially believed that the attacks were conducted by the Termite ransomware gang, the exploitation techniques used matched those previously used by the Clop ransomware gang. After reaching out to Clop, the gang confirmed that they were responsible for the recent exploitation of the Cleo vulnerability detected by Huntress and the original CVE-2024-50623 flaw. The ransomware group has now announced that they are deleting data associated with past attacks from their data leak server and will only work with new companies breached in the Cleo attacks.

The Clop ransomware gang has a history of targeting previously unknown vulnerabilities in secure file transfer platforms for data theft attacks. In December 2020, they exploited a zero-day in the Accellion FTA secure file transfer platform, impacting nearly 100 organizations. In 2023, they exploited a zero-day in the GoAnywhere MFT platform, stealing data from over 100 companies. Their most significant attack was using a zero-day in the MOVEit Transfer platform, which enabled them to steal data from 2,773 organizations, as reported by Emsisoft.

At the moment, the extent of the impact of the Cleo data theft attacks is unclear, and there is no information about any companies confirming a breach through the platform.

Related News

• Cleo MFT Zero-Day Exploits Set to Surge: Cleopatra Backdoor and Ransomware Campaigns in Focus
• Termite Ransomware Group Suspected Behind Zero-Day Exploits in Cleo Software

Latest News

• Cleo MFT Zero-Day Exploits Set to Surge: Cleopatra Backdoor and Ransomware Campaigns in Focus
• Russian Cyber-Espionage Group Turla Uses Other Hackers' Infrastructure to Target Ukraine Military Devices
• Ivanti Addresses Critical Vulnerabilities in its Cloud Services Appliance Solution
• Microsoft Resolves 72 Security Flaws, Including an Actively Exploited CLFS Vulnerability
• U.S. Accuses Chinese National of Hacking 81,000 Sophos Firewalls Using Zero-Day Exploit