Online Extortion Gang Clop Threatens Cleo Hacking Victims

Share:

The Clop cybercriminal group is threatening to make public the companies swept up by its mass hacking of managed file-transfer software built by Cleo Communications.

See Also: Live Webinar | North Korea’s Secret IT Army and How to Combat It

Clop, aka Cl0p, a ransomware extortion organization believed to be based in Russia, took responsibility earlier this month for mass attacks targeting Harmony, VLTrader and LexiCom MFT software built by Rockford, Illinois-based Cleo (see: Clop Ransomware Takes Responsibility for Cleo Mass Exploits).

In a Dec. 24 update to its dark web leak site, Clop asserted it has “data of many companies who use Cleo” and that it will publish within 48 hours a list of at least 66 companies it hacked. The criminal gang said it is contacting the companies with extortion instructions after already publishing the first five characters in their names.

Cleo hurried a patch out to users on Dec. 11 following signs of mass exploitation. Hackers appeared to be exploiting an unrestricted file upload vulnerability in the managed file transfer tracked as CVE-2024-50623, for which a patch published in October apparently did not fully prevent hacks. Analysis by Rapid7 suggested hackers might have used a new file-write vulnerability, CVE-2024-55956, for writing a malicious host file to the targeted system and then exploiting CVE-2024-50623 to obtain needed credentials and force the system to run the malicious host file, which allows them to remotely execute code.

Cleo has told customers it “strongly advises” them to immediately apply the latest fix.

How long attackers have been exploiting one or both flaws remains unclear. “The campaign began on Dec. 7, and is ongoing as of the publication of this article,” Arctic Wolf said in a Thursday blog post.

Clop is no stranger to mass zero-day exploitation of file transfer software. The group launched a carefully prepared attack against MOVEit software that unfolded over the U.S. Memorial Day weekend in 2023. The count of organizations affected directly or indirectly by the MOVEit incident stands at over 2,770, with data pertaining to more than 95 million individuals exposed, calculates security firm Emsisoft.

Earlier in 2023, Clop took responsibility for a large-scale attack campaign that exploited a zero-day vulnerability to steal data from customers of Fortra’s widely used managed file transfer software GoAnywhere MFT. In December 2020, it targeted zero-day flaws in the Accellion File Transfer Appliance in another global attack campaign.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
7:47 pm, Feb 6, 2025
weather icon 6°C
L: 5° | H: 6°
broken clouds
Humidity: 80 %
Pressure: 1039 mb
Wind: 10 mph ENE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 75%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 7:30 am
Sunset: 4:58 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
5° | 6°°C 0 mm 0% 12 mph 80 % 1038 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
3° | 5°°C 1 mm 100% 13 mph 96 % 1037 mb 0 mm/h
Sat Feb 08 9:00 pm
weather icon
4° | 6°°C 1 mm 100% 12 mph 95 % 1027 mb 0 mm/h
Sun Feb 09 9:00 pm
weather icon
5° | 8°°C 0 mm 0% 11 mph 95 % 1037 mb 0 mm/h
Mon Feb 10 9:00 pm
weather icon
3° | 5°°C 0.2 mm 20% 11 mph 94 % 1036 mb 0 mm/h
Today 9:00 pm
weather icon
4° | 6°°C 0 mm 0% 12 mph 80 % 1038 mb 0 mm/h
Tomorrow 12:00 am
weather icon
4° | 5°°C 0 mm 0% 12 mph 80 % 1037 mb 0 mm/h
Tomorrow 3:00 am
weather icon
3° | 4°°C 0 mm 0% 11 mph 82 % 1035 mb 0 mm/h
Tomorrow 6:00 am
weather icon
4° | 4°°C 0 mm 0% 12 mph 77 % 1030 mb 0 mm/h
Tomorrow 9:00 am
weather icon
4° | 4°°C 0 mm 0% 13 mph 74 % 1028 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
3° | 3°°C 0.89 mm 89% 12 mph 91 % 1025 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
4° | 4°°C 1 mm 100% 13 mph 91 % 1022 mb 0 mm/h
Tomorrow 6:00 pm
weather icon
3° | 3°°C 1 mm 100% 10 mph 89 % 1020 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,656.63
-1.41%
Ethereum(ETH)
€2,603.19
-2.82%
Tether(USDT)
€0.97
0.01%
XRP(XRP)
€2.22
-5.30%
Solana(SOL)
€183.16
-4.82%
USDC(USDC)
€0.97
0.00%
Dogecoin(DOGE)
€0.236808
-5.27%
Shiba Inu(SHIB)
€0.000014
-6.16%
Pepe(PEPE)
€0.000009
-7.69%
Scroll to Top