Mass Exploitation of Cleo File Transfer RCE Enables Backdoors and Data Theft

Attackers exploited critical unauthenticated command-execution vulnerability CVE-2024-55956 in Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.24 during a mass exploitation campaign beginning in December 2024. The flaw abuses the products’ Autorun functionality to import and execute arbitrary Bash or PowerShell commands and received a CVSS score of 9.8 from CISA ADP. It is distinct from CVE-2024-50623, which permits arbitrary file reading and writing; installations considered fully patched during the initial disclosures were still reportedly vulnerable. CISA added CVE-2024-55956 to its Known Exploited Vulnerabilities catalog on December 17, 2024. At the time of its advisory, Censys identified 1,442 internet-exposed Cleo instances, including 1,011 running unpatched versions—approximately 70% of the observed exposure.

Reported attacks deployed PowerShell stagers and a Java backdoor called Cleopatra. Darktrace investigated suspected exploitation, including at an energy-sector customer, observing unusual encrypted outbound transfers, Java execution, and encoded PowerShell activity; encryption prevented confirmation of some transferred contents, but the company reported blocking further suspicious connections and exfiltration attempts. Early reporting suspected Termite, while Cl0p later claimed the Cleo data-theft campaign and began publishing stolen data on January 24, 2025; independent attribution remained unresolved, although one victim confirmed the published data originated from its Cleo server. Cleo urged customers to upgrade to version 5.8.0.24. Defenders should verify remediation and investigate exposed systems for unauthorized Autorun activity, unexpected Java or PowerShell execution, and suspicious outbound transfers rather than treating patch installation as evidence that no compromise occurred.