Two critical vulnerabilities in Cleo file transfer software—CVE-2024-50623 and CVE-2024-55956—have been actively exploited, leading to unauthorized data access and system compromise. The Clop ransomware gang has claimed responsibility for these attacks, leveraging zero-day exploits to breach networks, steal data, and deploy ransomware. Despite patches released by Cleo, the initial fix for CVE-2024-50623 was incomplete, leaving systems vulnerable. Exploitation of these vulnerabilities involved uploading malicious files, installing backdoors, and executing commands, enabling lateral movement and data exfiltration.
CVE-2024-50623 was initially identified as a cross-site scripting vulnerability (CWE-79) but was later revised to an unrestricted file upload vulnerability (CWE-434), allowing remote code execution via malicious file uploads. This flaw affected Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21. Despite Cleo releasing a patch in October 2024, threat actors bypassed the fix, exploiting the vulnerability to upload Java-based backdoors. These backdoors enabled attackers to execute arbitrary commands, steal sensitive data, and escalate privileges within compromised networks, leaving organizations vulnerable to further attacks.
CVE-2024-55956, a separate critical vulnerability, allowed unauthenticated users to execute arbitrary bash or PowerShell commands through default Autorun directory settings. This vulnerability impacted Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.24. Following exploitation, attackers conducted reconnaissance using enumeration commands such as systeminfo and whoami. They deployed a Java-based RAT to launch PowerShell instances, which functioned as shellcode loaders. The PowerShell scripts decrypted and executed shellcode, ultimately downloading and running a 64-bit Cobalt Strike beacon DLL. Advanced attack techniques, including OverPass-The-Hash, were observed, allowing attackers to leverage NTLM hashes to obtain Kerberos tickets and escalate privileges within networks.
The Clop ransomware gang has claimed responsibility for these attacks, continuing their trend of targeting secure file transfer systems. Clop exploited both vulnerabilities, employing tactics similar to their previous campaigns. Their operation involved stealing sensitive data and deploying ransomware to encrypt devices across corporate networks.