Loading story…
A critical vulnerability in Cleo managed file-transfer software has been actively exploited in the wild, with CISA confirming its use in ransomware attacks and adding the flaw to its Known Exploited Vulnerabilities catalog. Reporting indicates the bug affects Cleo products used for secure file exchange, and defenders were urged to patch immediately, restrict internet exposure, and investigate signs of compromise as exploitation spread broadly.
Further reporting tied the campaign to activity dating back to October, with Mandiant tracing exploitation earlier than initially disclosed and indicating attackers had been abusing the Cleo flaw for weeks before public warnings intensified. The overlap between mass exploitation, confirmed ransomware use, and the extended dwell time raised concern that organizations relying on Cleo software may have been compromised well before detection and should review logs, isolate affected systems, and assess for follow-on intrusion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Mandiant publicly stated that its investigation traced the Cleo exploitation activity to October 2024, providing additional timeline and attribution context for the campaign. This disclosure clarified that the attacks had been ongoing for weeks before broader public awareness in December.
CISA confirmed that a critical Cleo vulnerability was being exploited in ransomware-related intrusions and added the issue to its Known Exploited Vulnerabilities catalog. The confirmation elevated the incident from active exploitation reporting to an officially recognized ransomware threat.
By early December 2024, security reporting indicated that a critical vulnerability in Cleo managed file-transfer software was under mass exploitation. The reporting highlighted active attacks affecting organizations using Cleo products.
Mandiant traced exploitation of vulnerabilities in Cleo Harmony, VLTrader, and LexiCom products back to October 2024, indicating attackers had been abusing the flaws before public reporting. The activity marked the start of the intrusion campaign later tied to widespread compromise and extortion activity.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritydive.com
Open sourcesocradar.io
Open sourcebleepingcomputer.com
Open sourcecybersecuritydive.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability, **CVE-2024-5806**, warning that a threat actor could exploit the flaw to take control of affected systems. CISA urged organizations to review Progress Software’s June 2024 alert and apply updates, while reporting indicated the bug was being attacked within hours of public disclosure, raising the risk of rapid compromise for internet-exposed file-transfer servers. The new exploitation wave revived scrutiny of the earlier MOVEit crisis, when the Clop ransomware-linked extortion campaign compromised organizations across the private and public sectors. Reported victims and affected entities included technology and IT firms, state and federal agencies, schools tied to the Teachers Insurance and Annuity Association of America retirement fund, Norton LifeLock owner Gen Digital, Vancouver Transit Police, Missouri agencies, and Extreme Networks, underscoring how vulnerabilities in widely deployed managed file-transfer software can cascade into broad supply-chain and data-theft incidents.
Jun 29, 2026
The list of organizations affected by the **MOVEit Transfer** breach continued to grow as reporting tied additional victims to the mass exploitation campaign against the managed file-transfer platform. The incident was widely linked to the **Clop** ransomware and extortion operation, which exploited a zero-day flaw in MOVEit to steal data from enterprises and institutions that used the software to exchange sensitive files. The expanding victim count underscored the broad downstream impact of third-party file-transfer compromises, with exposed data reportedly affecting banks, businesses, government entities, and other organizations connected to breached MOVEit deployments. The campaign highlighted how a single vulnerability in a widely used transfer product can rapidly become a large-scale supply-chain-style data theft event, forcing incident response, disclosure, and regulatory scrutiny across multiple sectors.
Jul 11, 2026
The Clop ransomware group has initiated a widespread data extortion campaign targeting Internet-exposed Gladinet CentreStack and Triofox file servers. Attackers are exploiting multiple vulnerabilities, including CVE-2025-11371 (an unauthenticated local file inclusion flaw), CVE-2025-14611 (hardcoded cryptographic keys), and CVE-2025-12480 (a critical remote code execution vulnerability in Triofox). These vulnerabilities allow unauthorized access, file retrieval, and even remote code execution, enabling Clop to steal sensitive corporate data and leave ransom notes on compromised systems. Security researchers and incident responders have observed active exploitation across at least 200 unique IP addresses, with evidence that both zero-day and unpatched n-day vulnerabilities are being leveraged. Gladinet CentreStack and Triofox are widely used by businesses for secure file storage and sharing, making the impact of these attacks potentially significant. The Clop group’s campaign follows their established pattern of targeting file transfer and sharing solutions, having previously compromised platforms such as MOVEit, GoAnywhere, and Oracle EBS. Security updates have been released by Gladinet to address some of the exploited flaws, but the ongoing attacks highlight the importance of timely patching and monitoring of Internet-facing file sharing infrastructure. Technical analysis by VulnCheck and Mandiant has provided detailed insights into the exploitation methods, emphasizing the complexity and sophistication of the attack chain.
Jun 29, 2026