Cl0p Expands Extortion Campaigns to Cleo, CentreStack, and Alleged Poultry Sector Victim

The Cl0p extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving Cleo LexiCom, VLTrader, and Harmony through CVE-2024-50623 and to a separate campaign targeting CentreStack file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version 5.8.0.21 might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site.

The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a New Zealand poultry producer was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the Accellion FTA and MOVEit mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.