Clop Ransomware Takes Responsibility for Cleo Mass Exploits

The ransomware group Clop is claiming responsibility for hacking instances of managed file-transfer software built by Cleo Communications. Many large organizations rely on the MFT server software to securely transfer files.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

Multiple cybersecurity firms reported seeing mass attacks targeting against Harmony, VLTrader and LexiCom MFT software built by Rockford, Illinois-based Cleo.

On Sunday, the Clop, aka Cl0p, ransomware group believed to be based in Russia, said it was behind the attacks, as Bleeping Computer first reported.

“Due to recent events (attack of Cleo) all links to data of all companies will be disabled and data will be permanently deleted from servers,” the ransomware operation’s message read. “We will work only with new companies.”

A supply-chain compromise of file transfer software is territory Clop has previously covered, and researchers are reviewing indicators of compromise including exploit code used to see if there appears to be significant crossover between Cleo attacks and previous Clop campaigns.

The promise to delete previously stolen data appears to be a reference to data Clop stole during a mass attack against MOVEit software that unfolded over Memorial Day in 2023. The count of organizations affected directly or indirectly by the MOVEit incident stands at over 2,770, with data pertaining to more than 95 million individuals exposed, calculates security firm Emsisoft.

Whether or not Clop is actually responsible for attacks targeting various types of Cleo’s MFT software couldn’t be confirmed. Separately, on Dec. 10, British cybersecurity expert Kevin Beaumont reported having evidence that the ransomware group Termite possessed a zero-day exploit for vulnerabilities in the Cleo products.

Security experts said both groups may well have been involved, either separately or together.

“Although Cl0p posted a message on their website, this is not hard evidence pointing to a single threat group’s involvement. Therefore, any discussion of whether Termite or Cl0p are behind this exploit is speculation until proven with other indicators/evidence,” said Christiaan Beek, senior director of threat analytics at cybersecurity firm Rapid7.

“We have seen Cl0p utilize complex chains similar to this vulnerability in multiple file transfer use cases before, such as MOVEit and Accellion FTA in 2021,” Beek added. “Cl0p usually uses pure zero-day chains or vulnerabilities. This was an ‘impure’ chain in that one of the vulnerabilities was fixed and potentially exploited before Cl0p started using it,” or at least “that we know of.”

Fresh Vulnerability Patched

The latest attacks appear to target in part CVE-2024-50623, an unrestricted file upload vulnerability in the managed file transfer products Cleo Harmony, VLTrader and LexiCom. Exploiting the vulnerability enables attackers to remotely execute code with escalated privileges.

On Friday, U.S. Cybersecurity and Infrastructure Security Agency added CVE-2024-50623 to its known exploited vulnerabilities catalog, saying it’s been tied to active ransomware attacks.

An exploit proof of concept published last week by WatchTowr shows that attackers can use CVE-2024-50623 to “write any file into any folder by using path=......,” Beaumont said in a post to social platform Mastodon.

Cleo patched CVE-2024-50623 in Harmony, VLTrader and LexiCom by releasing version 5.8.0.21 of each type of software, the company said in an October security advisory.

Last week, security experts initially questioned whether Cleo’s patch for CVE-2024-50623 fixed the problem. On Dec. 9, cybersecurity firm Huntress said it created a proof-of-concept version of an attack against the software and “learned the patch does not mitigate the software flaw.”

Based on information released by Cleo as well as cybersecurity firm Huntress, attackers might be chaining together two vulnerabilities, said Stephen Fewer, principal security researcher at Rapid7. In particular, he said they might be using a new file-write vulnerability, CVE-2024-55956, for “writing a malicious host file” to the targeted system, and then exploiting CVE-2024-50623 to obtain needed credentials and force the system to run the malicious host file, which allows them to remotely execute code.

On Wednesday, Cleo released a new security patch to address the more recent flaw. Cleo said that in versions of Cleo Harmony, VLTrader and LexiCom prior to 5.8.0.24, “an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.”

Attack Duration Unclear

How long attackers have been exploiting one or both flaws remains unclear. “The campaign began on Dec. 7, and is ongoing as of the publication of this article, Arctic Wolf said in a Thursday blog post.

When Cleo pushed patches in October, it also shared indicators of compromise, “implying the older bug’s been exploited for a minute,” Caitlin Condin, director of vulnerability intelligence at Rapid7, said in a Monday post to Mastodon. “Would sure be helpful to know more about who was doing that exploiting, particularly now that Cl0p has claimed credit for last week’s attack.”

So far, the Cleo-targeting campaign doesn’t resemble the mass attacks on users of Progress Software’s MOVEit secure file-transfer software, or Accellion FTA, in a notable way. Namely, the fallout appears to be far less.

“I think the Cleo thing shows the industry and community working very well,” Beaumont said.

By Friday, he said, about two-thirds of all vulnerable servers appear to either have been patched or temporarily taken offline. “As far as I know, since mass exploitation began (important caveat) none of the victims had follow-on activity, i.e. ransomware,” he said. “That’s a really good outcome. The reason, I think, is openness and transparency – Huntress went public early and everybody leaped on it loudly in the community. Be more open.”