Loading story…
Attackers are actively exploiting critical vulnerabilities in Cleo Harmony, Cleo VLTrader, and Cleo LexiCom managed file transfer software, including CVE-2024-50623 and the related CVE-2024-55956. The flaws affect versions prior to 5.8.0.24 and allow remote, unauthenticated attackers to upload arbitrary files, execute commands, access sensitive data, and alter systems. Security researchers and vendor advisories reported in-the-wild exploitation, with public proof-of-concept exploit code increasing the risk of broad compromise.
Intrusions linked to the campaign have been associated with Clop data-theft activity, and exploitation was observed from at least early December 2024. Defenders were urged to immediately upgrade affected Cleo products to 5.8.0.24 or later, restrict external access to exposed file transfer servers, and review logs, autorun locations, and other persistence points for suspicious files or commands. The incident adds Cleo software to the list of heavily targeted file transfer platforms exploited for large-scale enterprise breaches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cleo states that CVE-2024-50623, affecting Harmony, VLTrader, and LexiCom, was patched in October 2024. Later reporting describes the newer CVE-2024-55956 as similar to this earlier flaw.
CSIRT.SK reports that the Clop ransomware group has used CVE-2024-55956 in data theft attacks against vulnerable Cleo deployments. No specific attack date is provided in the source content.
CSIRT.SK says public proof-of-concept exploit code is available for CVE-2024-55956, increasing the risk to exposed Cleo file transfer systems. The article does not specify when the PoC was released.
CSIRT.SK reports that attackers have been exploiting CVE-2024-55956 since at least 2024-12-03. The flaw affects Cleo Harmony, VLTrader, and LexiCom versions older than 5.8.0.24 and enables unauthenticated file upload and command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcehuntress.com
Open sourcesupport.cleo.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in Cleo managed file-transfer software has been actively exploited in the wild, with CISA confirming its use in ransomware attacks and adding the flaw to its Known Exploited Vulnerabilities catalog. Reporting indicates the bug affects Cleo products used for secure file exchange, and defenders were urged to patch immediately, restrict internet exposure, and investigate signs of compromise as exploitation spread broadly. Further reporting tied the campaign to activity dating back to October, with Mandiant tracing exploitation earlier than initially disclosed and indicating attackers had been abusing the Cleo flaw for weeks before public warnings intensified. The overlap between mass exploitation, confirmed ransomware use, and the extended dwell time raised concern that organizations relying on Cleo software may have been compromised well before detection and should review logs, isolate affected systems, and assess for follow-on intrusion activity.
Jul 12, 2026
The **Cl0p** extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving **Cleo LexiCom, VLTrader, and Harmony** through `CVE-2024-50623` and to a separate campaign targeting **CentreStack** file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version `5.8.0.21` might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site. The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a **New Zealand poultry producer** was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the **Accellion FTA** and **MOVEit** mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.
Jun 29, 2026
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability, **CVE-2024-5806**, warning that a threat actor could exploit the flaw to take control of affected systems. CISA urged organizations to review Progress Software’s June 2024 alert and apply updates, while reporting indicated the bug was being attacked within hours of public disclosure, raising the risk of rapid compromise for internet-exposed file-transfer servers. The new exploitation wave revived scrutiny of the earlier MOVEit crisis, when the Clop ransomware-linked extortion campaign compromised organizations across the private and public sectors. Reported victims and affected entities included technology and IT firms, state and federal agencies, schools tied to the Teachers Insurance and Annuity Association of America retirement fund, Norton LifeLock owner Gen Digital, Vancouver Transit Police, Missouri agencies, and Extreme Networks, underscoring how vulnerabilities in widely deployed managed file-transfer software can cascade into broad supply-chain and data-theft incidents.
Jun 29, 2026