Clop Ransomware Extortion: 66 Cleo Data-Theft Victims and Counting

Summary

The Clop ransomware group is extorting at least 66 organizations following a data theft campaign exploiting vulnerabilities in Cleo file transfer software. This attack follows a pattern of Clop exploiting zero-day vulnerabilities in similar software, highlighting a concerning trend in cybersecurity. The situation continues to evolve, with the possibility of more victims emerging and the total number exceeding the initial 66 reported.

Explore the data solution with built-in protection against ransomware TrueNAS.

Main Story

So, Clop’s at it again, huh? This time, they’ve launched a pretty massive extortion campaign, hitting at least 66 organizations. And the way they did it? By exploiting vulnerabilities in Cleo file transfer software. Yeah, Cleo – the company that makes file transfer products like Cleo Harmony, VLTrader, and LexiCom. Turns out those products had some serious weaknesses, specifically CVE-2024-50623 and CVE-2024-55956, that Clop decided to take advantage of.

Now, Clop initially took credit for the attacks back in mid-December 2024, boasting about compromising a ton of targets. They even posted partial names of the victims on their dark web portal, you know, the usual intimidation tactic. Forty-eight hours to pay up or else they’d leak the names and data. It’s like a twisted game show, isn’t it?

And as of January 2025, they started leaking data. Honestly, I wouldn’t be surprised if the number of victims is even higher than what’s been reported so far. It’s a messy situation, to say the least.

One of the confirmed victims is Blue Yonder. You’ve heard of them, right? Supply chain management software provider, big names like Starbucks and some major grocery chains are their clients. Imagine the fallout from that! Apparently, the attack on Blue Yonder caused quite a bit of disruption, rippling through their customers’ operations, too. It just goes to show how interconnected everything is.

But here’s where it gets even more interesting. Another ransomware group, Termite, also claimed responsibility for the Blue Yonder attack, and there’s speculation they might’ve been involved in the broader Cleo exploitation, too. What’s the connection between Clop and Termite? Are they working together, or is one just piggybacking off the other? Or maybe it was just separate campaigns using the same vulnerabilities, who knows, but it’s definitely food for thought. Who would have thought?

This is just the latest in a long line of incidents involving Clop. They’ve got a real pattern of exploiting zero-day vulnerabilities in file transfer software. Remember the attacks on Accellion FTA, GoAnywhere MFT, and MOVEit Transfer? It’s basically their M.O. It really highlights how vulnerable file transfer software can be, and how critical it is to have solid security measures in place.

The impact of these attacks? It’s not just about the ransom money, though that’s bad enough. We’re talking reputational damage, operational disruptions, potential lawsuits, and the long-term costs of recovering and beefing up security. It’s a serious wake-up call for anyone who thinks cybersecurity isn’t a top priority.

So, what can you do if your organization uses file transfer software? First, patch those vulnerabilities – and fast! Implement strong access controls, back up your data regularly, and make sure you have a solid incident response plan. You need to stay on top of emerging threats and cybersecurity best practices. After all, It’s better to be prepared than to be the next victim.

As of today, February 8, 2025, the situation is still unfolding, and the full extent of the damage from the Cleo attacks is still unclear. But one thing’s for sure: ransomware isn’t going away anytime soon, and we need to be ready for it.