Critical Cleo File-Transfer Flaw Exploited in Ransomware Intrusions

A critical vulnerability in Cleo managed file-transfer software has been actively exploited in the wild, with CISA confirming its use in ransomware attacks and adding the flaw to its Known Exploited Vulnerabilities catalog. Reporting indicates the bug affects Cleo products used for secure file exchange, and defenders were urged to patch immediately, restrict internet exposure, and investigate signs of compromise as exploitation spread broadly.

Further reporting tied the campaign to activity dating back to October, with Mandiant tracing exploitation earlier than initially disclosed and indicating attackers had been abusing the Cleo flaw for weeks before public warnings intensified. The overlap between mass exploitation, confirmed ransomware use, and the extended dwell time raised concern that organizations relying on Cleo software may have been compromised well before detection and should review logs, isolate affected systems, and assess for follow-on intrusion activity.