Clop Ransomware Targets Cleo Users with Data Theft Ultimatum

The notorious Clop ransomware gang has struck again, leveraging a critical zero-day vulnerability (CVE-2024-50623) in Cleo's software products to execute data theft on a massive scale. The group has threatened to expose the identities of 66 victim companies within 48 hours unless ransom demands are met.

This marks another high-profile operation by Clop, which has exploited vulnerabilities in platforms like MOVEit Transfer, SolarWinds Serv-U, and Accellion FTA in the past.

In its latest announcement on its dark web leak portal, Clop has published partial names of companies it claims ignored their ransom demands. The cybercriminals are actively contacting victims through secure chat links and email, urging them to negotiate and avoid public exposure.

Exploited Vulnerability: CVE-2024-50623

The Cleo data breach centers around a zero-day flaw in LexiCom, VLTrader, and Harmony software products. Tracked as CVE-2024-50623, the vulnerability allows unrestricted file uploads and downloads, enabling attackers to:

Perform remote code execution, gaining control over compromised networks.

Open reverse shells, creating backdoors for further exploitation.

Vendor Response and Patch Status

Cleo has released a patch in version 5.8.0.21, urging users to update immediately. However, researchers from Huntress warn that the patch can be bypassed, highlighting an urgent need for further scrutiny.

Clop’s Extortion Tactics

The group’s strategy underscores its increasing boldness and sophistication. By publishing partial company names on its leak site, Clop intensifies pressure on victims, leveraging:

1. Direct Communication: Secure chat links and dedicated email channels to facilitate negotiations.

2. Public Exposure: Threats to disclose full company names if demands are unmet within the 48-hour deadline.

3. Strategic Hinting: Using partial names and public clues to reveal victims, creating a ripple of reputational damage.

A Larger Impact Looms

While 66 companies have been publicly named, cybersecurity expert Yutaka Sejiyama warns the actual list may be significantly larger. With Cleo software used by over 4,000 organizations worldwide, the full scope of this breach remains uncertain.

History of High-Profile Breaches

Clop’s modus operandi revolves around exploiting zero-day vulnerabilities to infiltrate high-value targets. Previous operations include:

MOVEit Transfer Attack: Compromising government agencies and Fortune 500 firms.

SolarWinds Serv-U Breach: Using vulnerabilities to access sensitive systems.

Accellion FTA Exploit: Stealing data from financial institutions and universities.

This calculated approach solidifies Clop’s position as one of the most formidable ransomware gangs globally.

Mitigation Measures: Protecting Your Network

Organizations using Cleo products must act swiftly to mitigate risks. Here’s what you can do:

1. Immediate Patch Deployment

Update to Cleo Harmony, VLTrader, and LexiCom version 5.8.0.21.

Verify patch integrity to ensure no bypass vulnerabilities exist.

2. Proactive Network Monitoring

Identify unauthorized file transfers or abnormal system activity.

Leverage intrusion detection tools to isolate suspicious behavior.

3. Incident Response Activity

Establish an incident response team to address potential breaches.

Create data backups to minimize impact during ransomware attacks.

4. External Support

Engage cybersecurity experts to perform vulnerability assessments.

Notify stakeholders and legal teams to prepare for potential exposure.

Industry Implications

This attack once again highlights the systemic vulnerabilities in widely-used software. It underscores the need for:

Robust Vendor Practices: Regular penetration testing and faster patch deployment.

Enhanced Cyber Hygiene: Organizations must adopt zero-trust architectures and strict access controls.

Global Cooperation: Governments and private entities need to collaborate to combat ransomware gangs.

Clop Ransomware Targets Cleo Users with Data Theft Ultimatum

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence