Clop Ransomware Launches New Extortion Campaign: Cleo Data-Theft Breach

The infamous Clop ransomware gang has escalated its operations, targeting companies impacted by a Cleo data-theft attack. With a list of 66 companies already announced, the group has issued a chilling ultimatum: victims have 48 hours to respond to ransom demands, or face public exposure of their identities and data.

This latest campaign highlights Clop’s continued exploitation of zero-day vulnerabilities in widely used software, raising alarm bells across the cybersecurity community.

The Cleo Breach: A Major Security Incident

The attack exploited a zero-day vulnerability (CVE-2024-50623) in Cleo LexiCom, VLTrader, and Harmony products. This flaw allowed Clop to perform unrestricted file uploads and downloads, ultimately enabling remote code execution. Using this method, the group infiltrated the networks of several organizations, stealing sensitive data.

While Clop has published partial company names of victims who failed to respond to their demands, the gang warns that the full list will be disclosed if no negotiations occur. Notably, Clop has a history of targeting secure file transfer platforms, including:

Accellion FTA
GoAnywhere MFT
MOVEit Transfer
SolarWinds Serv-U FTP
How Clop Operates

In this latest extortion round, Clop has taken a more aggressive approach:

Direct Communication: Victims are being contacted directly via email or secure chat links to facilitate ransom payment discussions.
Public Threats: The gang has published partial company names on its dark web portal to pressure victims into engaging.
Focus Shift: Clop claims to have deleted data from prior attacks, signaling a shift in focus to this new campaign.
The Vulnerability: CVE-2024-50623

The zero-day vulnerability exploited by Clop is tracked as CVE-2024-50623. It allows attackers to execute malicious actions, such as:

Unrestricted file uploads and downloads
Remote code execution
Reverse shell openings on compromised networks

Although Cleo released a fix for the vulnerability in version 5.8.0.21, cybersecurity researchers, including Huntress, have raised concerns that the patch can be bypassed.

Implications for Businesses

With Cleo’s software reportedly used by over 4,000 organizations worldwide, the scope of this breach is potentially massive. Even the partial company names shared by Clop can be cross-referenced with public Cleo server data, enabling identification of victims.

Organizations affected by the breach face:

Reputational damage if sensitive data is exposed.
Operational disruptions caused by compromised systems.
Increased financial pressure from ransom demands and potential fines.
Mitigation Measures

In light of the attack, businesses are urged to take immediate action:

Update Cleo Products: Ensure all software is updated to the latest version (5.8.0.21).
Monitor Systems: Look for signs of compromise, including unauthorized file transfers or unusual network activity.
Engage Experts: Consult cybersecurity professionals to strengthen defenses and manage incident response.
Enhance Vulnerability Management: Regularly audit systems for vulnerabilities and implement patches promptly.
Clop’s Evolving Threat Landscape

This latest attack underscores Clop’s growing sophistication and ability to exploit vulnerabilities in critical software. Their strategy of combining technical exploitation with aggressive extortion tactics sets a troubling precedent for future ransomware campaigns.

Conclusion: A Call to Action

The Cleo data-theft breach is a stark reminder of the persistent threat posed by ransomware gangs like Clop. Organizations must prioritize cybersecurity as a core business function, implementing robust defenses and proactive measures to mitigate risks.

In a world where cyber threats evolve daily, vigilance and preparation are the best defense.

Stay informed. Stay secure.