Unpatched Cleo Managed File-Transfer Software

More than 200 Cleo managed file-transfer servers remain internet-exposed and unpatched, despite warnings of a mass attack targeting critical vulnerabilities in the software.

See Also: How to Empower IT with Immutable Data Vaults

“File-transfer software continues to be a target for adversaries, and for financially motivated threat actors in particular,” said cybersecurity firm Rapid7. The company recommends taking “emergency action to mitigate risk related to this threat” by taking offline affected software until it’s been updated using the latest, fully patched software, released Dec. 11, which is version 5.8.0.24.

Rockford, Illinois-based Cleo Communications says 4,000 organizations use its file-transfer software.

On Wednesday, a non-exhaustive search using internet of things search engine Shodan counted at least 400 internet-exposed Cleo MFT servers, mostly U.S.-based. Of those 400 servers, only 199 were running the fully patched version 5.8.0.24. Of the rest, 125 ran version 5.8.0.21, which Cleo released to patch a flaw, although the patch may not have completely fixed the problem. The remaining 76 servers ran an older version of the MFT software with two now known, critical vulnerabilities.

The Clop ransomware operation this week on its leak site posted a “Happy New Year” message suggesting it perpetrated the Cleo mass exploits. If true, this would be the fifth time the data-stealing extortionist group targeted vulnerabilities in widely used file-transfer software to steal data and hold it to ransom.

The mass attacks against the Cleo software first came to light Dec. 9, thanks to cybersecurity firm Huntress warning it “directly observed evidence of threat actors exploiting this software en masse and performing post-exploitation activity.”

Huntress said the attacks began by Dec. 3 and targeted at least 28 of its customers. Rapid7 also confirmed seeing attacks against its customers – it didn’t say how many – in that timeframe, as did Arctic Wolf. Sophos said Dec. 11 that more than 50 unique hosts across its customer base had been targeted, starting Dec. 6, and that “the majority of affected customers are retail organizations” with a branch or base of operations in North America.

Cybersecurity firm Darktrace on Monday said it saw “multiple cases” of apparent Cleo software in its customers’ environments “engaging in unusual behavior.” In one case, an unnamed energy sector customer got hit on Dec. 8, when Darktrace detected a Cleo server transferring around over 500 megabytes of data to an IP address based in Lithuania that other firms have also tied to Cleo-targeting attacks.

At about the same time, another device on the customer’s network “exhibited similar data transfer and command execution activity” and sent nearly 600 megabytes via SSL to a different external IP address hosted by Dutch hosting provider Scalaxy B.V., Darktrace said.

Rapid7 recommends organizations using the vulnerable Cleo software review their logs for indicators of compromise and signs of post-exploitation activity both it and cybersecurity firm Huntress have published, looking “for suspicious activity dating back to at least Dec. 3.”

Two different flaws have come to light in the vulnerable Cleo products, all of which use the company’s VersaLex software. Cleo’s website describes the affected products as:

• Cleo Harmony: File-transfer server aimed at large enterprises;




• Cleo VLTrader: “A server-level solution designed to meet the needs of mid-enterprise organizations”;




• Cleo LexiCom: A desktop-based client application designed to communicate with “major trading community networks,” which includes “pre-configured hosts for specific networks including Wal-Mart, Target, Lowe’s, Meijer, Army/Air Force (AAFES), Dollar General, UCCnet, Global eXchange Services, IBM Information Exchange and many others.”

Of the two flaws being targeted, Cleo patched CVE-2024-50623 in October by releasing version 5.8.0.21 of all affected products. In its Dec. 9 warning over active attacks, Huntress suggested Cleo’s patch failed to fully fix the problem. Cleo first described the flaw as a cross-site scripting vulnerability, but revised its security alert to acknowledge that the flaw also allowed for unrestricted file upload (see: Hackers Exploiting Cleo Software Zero-Day).

On Dec. 10, Cleo warned customers of another flaw, now tracked as CVE-2024-55956 and appeared to release a fix at around the same time. This came in the form of a new, version 5.8.0.24 for all three pieces of software.

That update “addresses a critical vulnerability which exploits the ability for unrestricted file upload and download and execute malicious host definitions in the product,” Cleo said in its release notes. “After applying the patch, errors are logged for any files found at startup related to this exploit, and those files are removed.”

On Dec. 10, IoT search engine Censys reported seeing via its internet of things searches 1,342 instances of the three different types of Cleo software, of which 79% appeared to be U.S.-based. In addition, 13% appeared to be associated with the Microsoft Azure cloud service. At that time, none had yet been fully patched.

Some security researchers initially suspected that the second flaw provided a way to bypass the patch for the previous flaw, given apparent similarities in how the attacks worked. After further study, they revised that assessment. “In summary, while these two vulnerabilities (CVE-2024-50623 and CVE-2024-55956) are similar in that both allow an unauthenticated attacker to write arbitrary files, the exploitation strategy in each case was very different,” Rapid7 said in a vulnerability analysis.

For the latter and more powerful flaw, it said that “an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.”

Clop may have discovered multiple vulnerabilities in Cleo, begun exploiting CVE-2024-50623, and after that got patched switched to targeting CVE-2024-55956, researchers said (see: New Malware Framework Targets Cleo File Systems).

At least one payload being dropped by the vulnerability-exploiting attackers was a Java Archive – a .jar file – designed to function as a remote-access Trojan, said Christiaan Beek, Rapid7’s senior director of threat analytics, in a blog post. “This RAT facilitated system reconnaissance, file exfiltration, command execution and encrypted communication with the attacker’s command-and-control (C2) server,” he said.

The total number of Cleo-using organizations that might have fallen victim to these data-exfiltration attacks remains unclear.

“It is plausible that Clop had prior knowledge of several vulnerabilities in the Cleo platform, enabling the group to breach and extract data from victim organizations systematically long before the vendor issued any public security advisory,” threat intelligence firm Intel 471 told Information Security Media Group. “By timing their public disclosures and media engagement, the group likely intends to maximize the pressure on victims and amplify the overall impact of these attacks.”