Critical Flaws, Stolen Data, and Relentless Extortion: Clop Capitalizes on Cleo’s Software Vulnerabilities

The Clop ransomware group, notorious for its massive MOVEit Transfer supply chain attack in 2023, is back in the headlines. This time, the group has claimed responsibility for exploiting vulnerabilities in Cleo’s widely used file transfer platforms—Harmony, VLTrader, and LexiCom. The campaign has exposed gaps in enterprise security and highlighted Clop’s ability to exploit software flaws with precision and persistence.

Initial reports suggested that a new ransomware group, Termite, was behind the Cleo compromises. However, Clop’s statement claiming responsibility for its so-called “CLEO Project” clarified the situation. In an unusual twist, Clop announced it had permanently deleted some data stolen from victims before Cleo issued its December patch—a gesture the group framed as an act of goodwill. Yet, the goodwill stops there. Data compromised after the patch remains firmly under Clop’s control, as the group continues its relentless extortion efforts.

Clop’s operation began by targeting CVE-2024-50623, a critical vulnerability allowing unrestricted file uploads and downloads on Cleo platforms. This flaw, patched in October, failed to halt Clop’s momentum. Instead of retreating, the group escalated its efforts by shifting focus to a newly identified flaw, CVE-2024-55956, which emerged in December. This vulnerability, distinct from its predecessor, facilitates unauthenticated file writes, enabling attackers to plant malicious files within affected systems directly

This isn’t Clop’s first rodeo. The MOVEit campaign saw the group breach nearly 2,800 organizations, looting sensitive data and exposing millions of users. With Cleo, Clop has refined its approach, moving with surgical precision to exploit enterprise software central to critical file-sharing workflows.

Clop’s ability to adapt and capitalize on patched yet still vulnerable systems reveals a troubling trend. The group’s attacks are not random—they’re part of a calculated strategy to destabilize organizations, extract data, and demand ransoms under the threat of public leaks. The Cleo vulnerabilities, active since early December, granted attackers remote code execution capabilities, effectively handing them the keys to their victims’ digital kingdoms.

Still, Clop’s playbook doesn’t end with infiltration. The group has threatened to replace its leak site with fresh data stolen in these attacks, keeping pressure on victims and ensuring a continuous flow of ransom payments. The group's tactics exemplify the evolution of ransomware beyond mere disruption—it’s now a data-driven extortion business. While Clop’s MOVEit campaign primarily targeted sensitive user information, its Cleo-related exploits signal a shift toward broader enterprise disruption. By leveraging flaws in critical file-transfer software, Clop not only accesses sensitive organizational data but also demonstrates how vulnerabilities in seemingly mundane systems can have far-reaching consequences.

No longer confined to system lockdowns and quick payouts, ransomware has evolved into a sophisticated, data-driven extortion model. Assets like the sensitive information harvested—intellectual property, customer records, and proprietary code—become bargaining chips in a high-stakes game where attackers hold all the leverage.

So, as Clop’s operations continue to evolve, the question remains: how prepared are organizations to face adversaries who turn digital cracks into cyber highways? For now, Clop remains a step ahead, exploiting gaps in the system and reshaping the cybercrime landscape.