The Clop ransomware gang has confirmed to BleepingComputer that they’re behind the latest Cleo data-theft assaults, using zero-day exploits to breach company networks and steal information.
Cleo is the developer of the managed file switch platforms Cleo Concord, VLTrader, and LexiCom, which firms use to securely trade recordsdata between their enterprise companions and clients.
In October, Cleo mounted a vulnerability tracked as CVE-2024-50623 that allowed unrestricted file uploads and downloads, resulting in distant code execution.
Nonetheless, cybersecurity agency Huntress found final week that the unique patch was incomplete and menace actors have been actively exploiting a bypass to conduct information theft assaults.
Whereas exploiting this vulnerability, the menace actors have been importing a JAVA backdoor that allowed the attackers to steal information, execute instructions, and achieve additional entry to the compromised community.
On Friday, CISA confirmed that the crucial CVE-2024-50623 safety vulnerability in Cleo Concord, VLTrader, and LexiCom file switch software program has been exploited in ransomware assaults. Nonetheless, Cleo by no means publicly disclosed that the unique flaw they tried to repair in October was exploited.
Clop claims duty for Cleo information theft assaults
It was beforehand thought that the Cleo assaults have been performed by a brand new ransomware gang named Termite. Nonetheless, the Cleo information theft assaults tracked extra carefully to earlier assaults performed by the Clop ransomware gang.
After contacting Clop on Tuesday, the ransomware gang confirmed to BleepingComputer that they’re behind the latest exploitation of the Cleo vulnerability detected by Huntress in addition to the exploitation of the unique CVE-2024-50623 flaw mounted in October.
“As for CLEO, it was our undertaking (together with the earlier cleo) – which was efficiently accomplished.
All the knowledge that we retailer, when working with it, we observe all safety measures. If the info is authorities providers, establishments, drugs, then we are going to instantly delete this information with out hesitation (let me remind you in regards to the final time when it was with moveit – all authorities information, drugs, clinics, information of scientific analysis on the state stage have been deleted), we adjust to our laws.
with love © CL0P^_”
❖ Clop advised BleepingComputer
The extortion gang has now introduced that they’re deleting information related to previous assaults from their information leak server and can solely work with new firms breached within the Cleo assaults.
“Pricey firms, As a consequence of latest occasions (assault of CLEO) all hyperlinks to information of all firms might be disabled and information might be completely deleted from servers. We are going to work solely with new firms,” reads a brand new message on the gang’s CL0P^_- LEAKS extortion web site.
“Comfortable New Yr © CL0P^_ all the victims from their information leak web site.”
Supply: BleepingComputer
BleepingComputer requested Clop when the assaults started, what number of firms have been impacted, and if Clop was affiliated with the Termite ransomware gang, however didn’t obtain a response to those questions.
BleepingComputer additionally contacted Cleo on Friday to verify if Clop was behind the exploitation of the vulnerabilities however didn’t obtain a response.
Specializing in exploit file switch platforms
The Clop ransomware gang, aka TA505 and Cl0p, launched in March 2019, when it first started concentrating on the enterprise utilizing a variant of the CryptoMix ransomware.
Like different ransomware gangs, Clop breached company networks and slowly unfold laterally by its techniques whereas stealing information and paperwork. Once they have harvested all the things of worth, they deployed ransomware on the community to encrypt its gadgets.
Nonetheless, since 2020, the ransomware gang has specialised in concentrating on beforehand unknown vulnerabilities in safe file switch platforms for information theft assaults.
In December 2020, Clop exploited a zero-day within the Accellion FTA safe file switch platform, which impacted almost 100 organizations.
Then in 2021, the ransomware gang exploited a zero-day in SolarWinds Serv-U FTP software program to steal information and breach networks.
In 2023, Clop exploited a zero-day within the GoAnywhere MFT platform, permitting the ransomware gang to steal information from over 100 firms once more.
Nonetheless, their most vital assault of this type was utilizing a zero-day within the MOVEit Switch platform that allowed them to steal information from 2,773 organizations, in keeping with a report by Emsisoft.
Presently, it isn’t clear what number of firms have been impacted by the Cleo information theft assaults, and BleepingComputer doesn’t know of any firms who’ve confirmed being breached by the platform.
The U.S. State Division’s Rewards for Justice program at the moment has a $10 million bounty for info linking the Clop ransomware assaults to a international authorities.