Cl0p broke into Cleo with two zero-days — and the first patch didn't stop them

October 2024. Cleo ships a patch for an arbitrary file-upload flaw across all three of its managed file transfer products: Harmony, VLTrader, and LexiCom.

December 2024. Huntress researchers watch attackers walk through servers that already applied that patch. Cl0p — the group behind MOVEit and GoAnywhere — has worked through not one but two zero-days in the same platform. The first fix blocked almost nothing.

February 2025. Cl0p posts a list of 182 organizations compromised through Cleo on its dark web leak site. Hertz, WK Kellogg, Western Alliance Bank, Chicago Public Schools, Blue Yonder, Sam’s Club: the confirmed names are a gut punch.

This is not a one-off. It is Cl0p’s fourth MFT target in four years: Accellion (2020–2021), GoAnywhere (2023), MOVEit (2023), and now Cleo. Every campaign follows the same surgical script: a widely deployed file-transfer platform, exposed to the internet, and a zero-day that opens the door to silent exfiltration.

CVE-2024-50623: the October flaw everyone thought was fixed

Cleo disclosed CVE-2024-50623 in late October 2024 as an unauthenticated file read-and-write vulnerability. All three products are affected: Harmony (the enterprise platform), VLTrader (mid-market), LexiCom (the desktop client). The score is CVSS 9.8 — critical. The vendor ships version 5.8.0.21 and moves on.

Cl0p does not move on.

On 3 December 2024, Huntress begins detecting active exploitation — including on servers that had already applied the October patch. The vector is brutally simple: attackers drop malicious XML files into Cleo’s Autorun directory. This folder is designed to automatically process uploaded content, and it executes those files with the permissions of the Cleo service. The result: unauthenticated remote code execution on internet-facing servers.

The chain repeats identically across every victim:

1. An XML file dropped into Autorun
2. An embedded PowerShell command that fetches a Java (JAR) archive from attacker infrastructure
3. A Java loader injecting the final payload into memory

At the time of disclosure, Censys counted 1,342 Cleo instances exposed to the public internet. 79 percent were in the United States.

CVE-2024-55956: the patch that wasn’t a patch

This is where the Cleo story breaks from the MOVEit template. The October patch did not hold.

Huntress reports that servers running the supposedly fixed version 5.8.0.21 continue to be compromised. On 13 December 2024, a second CVE is assigned — CVE-2024-55956 — and a new patch ships in version 5.8.0.24.

Cleo’s official position: the two vulnerabilities have different root causes. CVE-2024-50623 is a read-and-write flaw; CVE-2024-55956 is a separate write-only flaw that reaches command execution through the same Autorun directory. Cleo insists: this is not a bypass.

Huntress and several other research teams disagree. From a defender’s perspective, servers believed to be patched remained exploitable, and a second emergency fix was needed. The semantics don’t matter: the organizations that applied the October patch and closed the ticket found themselves compromised in November and December.

The CISA added both CVEs to the KEV catalog (Known Exploited Vulnerabilities).

Cleopatra: an implant built for Cleo

Arctic Wolf Labs documented the post-exploitation activity and named the resulting implant Cleopatra. The chain is identical on every compromised server:

1. Initial access via Autorun — a malicious XML dropped
2. PowerShell stager embedded in the XML — fetches a Java loader
3. Java backdoor (Cleopatra) loaded into memory — persistence, command execution, exfiltration

Cleopatra is not a generic implant. It was purpose-built for Cleo servers: it uses Cleo’s own Java runtime to blend in with legitimate processes, and its obfuscation makes static detection difficult without dedicated signatures. Like LEMURLOOT before it (the MOVEit implant), Cleopatra prioritizes data theft over encryption.

Different vulnerability classes, different implants. The outcome does not change: persistent access to a platform handling critical data, then exfiltration no one sees coming.

Attribution: Cl0p, Termite, and the FIN11 cluster

Attribution took a few weeks to settle. Early reporting pointed to a newer ransomware group called Termite, linked to a supply chain incident at Blue Yonder. Termite operated public-facing Cleo infrastructure and appeared to have exploit capability against the platform — enough to muddy the waters.

By mid-December, Cl0p formally claimed responsibility. Mandiant and Google Threat Intelligence Group have long linked Cl0p-branded operations to the financially motivated cluster tracked as FIN11. The two entities are not strictly identical — multiple actors have used the Cl0p brand over the years — but for a defender, the attribution debate is secondary.

What matters is the consistency of the playbook: zero-day → silent exfiltration → mass email extortion targeting executives. Whether the operator is Cl0p, FIN11, or Termite, the method does not vary.

182 victims, three waves

Cl0p published its victims in waves, maximizing pressure with each release:

• 24 December 2024 — 66 victims announced with a 48-hour ultimatum
• 17–18 January 2025 — data published for organizations that refused to negotiate
• 14 February 2025 — 182 Cleo victims, full list

WhiteBlueOcean analysts counted over 200 organizations added to the leak site during December 2024 alone. Finance, logistics, retail, education, healthcare — no sector was spared, no obvious concentration.

Confirmed victims include Hertz (customer personal data stolen), WK Kellogg, Chicago Public Schools, Western Alliance Bank. At Sam’s Club, an ex-employee filed a $5 million class-action lawsuit — later withdrawn, but the damage was done.

Why MFT platforms are the perfect target

Cleo serves 4,200 customers globally. Its products sit between enterprises and their trading partners, moving payroll, vendor invoices, inventory data, and regulated records. Compromising one Cleo server does not breach one customer. It breaches every partner whose data flows through it.

The math is the same as MOVEit: one vulnerability, thousands of downstream targets. The MOVEit campaign affected an estimated 3,000 organizations and earned Cl0p between $75 and $100 million. For the group, MFT platforms are not targets of opportunity. They are a business model.

Detecting compromise

The indicators published by Huntress and Arctic Wolf let you search for Cleopatra traces. If you operate a Cleo server, start here:

# Traces of PowerShell execution in Cleo logs
grep -RiE 'powershell|Invoke-Expression|IEX|System\.Net\.WebClient' /var/log/cleo/

# Suspicious XML files in Autorun
find /opt/cleo/Autorun -name "*.xml" -mtime -90 -ls

# Outbound connections to known C2 infrastructure
# Full IOC list in the Arctic Wolf report

Any Cleo server exposed before December 2024 must be assumed compromised, even if it carried the October patch. A compromise assessment followed by a clean rebuild is the only prudent position. Do not attempt incremental cleanup: Cleopatra is designed to survive simple file deletion.

The verdict

If you are still running a Cleo product older than version 5.8.0.24, apply the patch immediately — but do not stop there.

The lesson of this campaign is not technical. It is procedural. The organizations that applied the October fix, checked the compliance box, and moved on are the ones Cl0p walked straight into six weeks later. A vendor’s first patch is not a guarantee. It can be insufficient. It can be bypassed. It can mask a second vulnerability the vendor itself has not yet identified.

For teams operating MFT platforms, three minimum measures:

• Expose the service behind a VPN or authenticated proxy, never directly on the internet
• Enable logging of executed commands and files deposited in Autorun
• Track vendor security bulletins with a sub-24-hour alert — not at the next quarterly review

The Cleo campaign is the fourth of its kind. It will not be the last.

References

• Cleo CVE-2024-50623 & CVE-2024-55956 Explained, CybelAngel REACT, 24 April 2026.
• Cl0p Ransom Group Returns with new Zero-day, Truesec, December 2024.
• Threat Advisory: Cleo software actively being exploited in the wild, Huntress, 3 December 2024.
• Cleopatra’s Shadow: A Mass Exploitation Campaign, Arctic Wolf Labs, 2024.
• CL0P’s Cleo Campaign: A Postmortem, White Blue Ocean, 12 September 2025.
• Cl0p ransomware claims responsibility for Cleo data-theft attacks, BleepingComputer, December 2024.
• CVE-2024-50623, CVE Program.
• CVE-2024-55956, CVE Program.
• CISA Known Exploited Vulnerabilities Catalog, CISA.