Dec 10, 2024Ravie LakshmananVulnerability / Threat Analysis

Users of Cleo-managed file transfer software are being urged to ensure that their instances are not exposed to the internet following reports of mass exploitation of a vulnerability affecting fully patched systems.

Cybersecurity company Huntress said it discovered evidence of threat actors exploiting the issue en masse on December 3, 2024. The vulnerability, which impacts Cleo’s LexiCom, VLTransfer, and Harmony software, concerns a case of unauthenticated remote code execution.

The security hole is tracked as CVE-2024-50623, with Cleo noting that the flaw is the result of an unrestricted file upload that could pave the way for the execution of arbitrary code.

The Illinois-based company, which has over 4,200 customers across the world, has since issued another advisory (CVE pending), warning of a separate “unauthenticated malicious hosts vulnerability that could lead to remote code execution.”

The development comes after Huntress said the patches released for CVE-2024-50623 do not completely mitigate the underlying software flaw. The issue impacts the below products and is expected to be patched later this week –

• Cleo Harmony (up to version 5.8.0.23)
• Cleo VLTrader (up to version 5.8.0.23)
• Cleo LexiCom (up to version 5.8.0.23)

In the attacks detected by the cybersecurity company, the vulnerability has been found to be exploited to drop multiple files, including an XML file that’s configured to run an embedded PowerShell command that’s responsible for retrieving a next-stage Java Archive (JAR) file from a remote server.

Specifically, the intrusions leverage the fact files placed in the “autorun” sub-directory within the installation folder and are immediately read, interpreted, and evaluated by the susceptible software.

As many as at least 10 businesses have had their Cleo servers compromised, with a spike in exploitation observed on December 8, 2024, at around 7 a.m. UTC. Evidence gathered so far pins the earliest date of exploration to December 3, 2024.

Victim organizations span consumer product companies, logistics and shipping organizations, and food suppliers. Users are advised to ensure that their software is up-to-date to ensure that they are protected against the threat.

Ransomware groups like Cl0p (aka Lace Tempest) have previously set their sights on various managed file transfer tools in the past, and it looks like the latest attack activity is no different.

According to security researcher Kevin Beaumont (aka GossiTheDog), “Termite ransomware group operators (and maybe other groups) have a zero-day exploit for Cleo LexiCom, VLTransfer, and Harmony.”

Cybersecurity company Rapid7 said it also has confirmed successful exploitation of the Cleo issue against customer environments. It’s worth noting that Termite has claimed responsibility for the recent cyber attack on supply chain firm Blue Yonder.

Broadcom’s Symantec Threat Hunter Team told The Hacker News that “Termite appears to be using a modified version of Babuk ransomware, which, when executed on a machine, encrypts targeted files and adds a .termite extension.”

“Since we saw that Blue Yonder had an instance of Cleo’s software open to the internet via Shodan, and Termite has claimed Blue Yonder amongst its victims, which was also confirmed by their listing and open directory of files, I’d say that Gossi is correct in his statement,” Jamie Levy, Huntress’ Director of Adversary Tactics, told the publication.

“For what it’s worth, there have been some rumblings that Termite might be the new Cl0p, there is some data that seems to support this as Cl0p’s activities have waned while Termite’s activities have increased. They are also operating in some similar fashions. We’re not really in the attribution game, but it wouldn’t be surprising at all if we are seeing a shift in these ransomware gangs at the moment.”

(This is a developing story. Please check back for more updates.)

In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

An FBI wanted poster for Matveev.

Matveev, a.k.a. “Wazawaka” and “Boriselcin” worked with at least three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies, U.S. prosecutors allege.

Russia’s interior ministry last week issued a statement saying a 32-year-old hacker had been charged with violating domestic laws against the creation and use of malicious software. The announcement didn’t name the accused, but the Russian state news agency RIA Novosti cited anonymous sources saying the man detained is Matveev.

Matveev did not respond to requests for comment. Daryna Antoniuk at TheRecord reports that a security researcher said on Sunday they had contacted Wazawaka, who confirmed being charged and said he’d paid two fines, had his cryptocurrency confiscated, and is currently out on bail pending trial.

Matveev’s hacker identities were remarkably open and talkative on numerous cybercrime forums. Shortly after being identified as Wazawaka by KrebsOnSecurity in 2022, Matveev published multiple selfie videos on Twitter/X where he acknowledged using the Wazawaka moniker and mentioned several security researchers by name (including this author). More recently, Matveev’s X profile (@ransomboris) posted a picture of a t-shirt that features the U.S. government’s “Wanted” poster for him.

An image tweeted by Matveev showing the Justice Department’s wanted poster for him on a t-shirt. image: x.com/vxunderground

The golden rule of cybercrime in Russia has always been that as long as you never hack, extort or steal from Russian citizens or companies, you have little to fear of arrest. Wazawaka claimed he zealously adhered to this rule as a personal and professional mantra.

“Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka wrote in January 2021 on the Russian-language cybercrime forum Exploit. “Mother Russia will help you. Love your country, and you will always get away with everything.”

Still, Wazawaka may not have always stuck to that rule. At several points throughout his career, Wazawaka claimed he made good money stealing accounts from drug dealers on darknet narcotics bazaars.

Cyber intelligence firm Intel 471 said Matveev’s arrest raises more questions than answers, and that Russia’s motivation here likely goes beyond what’s happening on the surface.

“It’s possible this is a shakedown by Kaliningrad authorities of a local internet thug who has tens of millions of dollars in cryptocurrency,” Intel 471 wrote in an analysis published Dec. 2. “The country’s ingrained, institutional corruption dictates that if dues aren’t paid, trouble will come knocking. But it’s usually a problem money can fix.

Intel 471 says while Russia’s court system is opaque, Matveev will likely be open about the proceedings, particularly if he pays a toll and is granted passage to continue his destructive actions.

“Unfortunately, none of this would mark meaningful progress against ransomware,” they concluded.

Although Russia traditionally hasn’t put a lot of effort into going after cybercriminals within its borders, it has brought a series of charges against alleged ransomware actors this year. In January, four men tied to the REvil ransomware group were sentenced to lengthy prison terms. The men were among 14 suspected REvil members rounded up by Russia in the weeks before Russia invaded Ukraine in 2022.

Earlier this year, Russian authorities arrested at least two men for allegedly operating the short-lived Sugarlocker ransomware program in 2021. Aleksandr Ermakov and Mikhail Shefel (now legally Mikhail Lenin) ran a security consulting business called Shtazi-IT. Shortly before his arrest, Ermakov became the first ever cybercriminal sanctioned by Australia, which alleged he stole and leaked data on nearly 10 million customers of the Australian health giant Medibank.

In December 2023, KrebsOnSecurity identified Lenin as “Rescator,” the nickname used by the cybercriminal responsible for selling more than 100 million payment cards stolen from customers of Target and Home Depot in 2013 and 2014. Last month, Shefel admitted in an interview with KrebsOnSecurity that he was Rescator, and claimed his arrest in the Sugarlocker case was payback for reporting the son of his former boss to the police.

Ermakov was sentenced to two years probation. But on the same day my interview with Lenin was published here, a Moscow court declared him insane, and ordered him to undergo compulsory medical treatment, The Record’s Antoniuk notes.

The US Navy, Air Force, and Marine Corps have grounded their fleet of Boeing-Bell-made Osprey V-22s on safety grounds.

A spokesperson for the Naval Air Systems Command (NAVAIR) told The Register that the decision had been made following an incident where one of the aircraft made an emergency landing.

“Out of an abundance of caution, NAVAIR recommended an operational pause for all V-22 Osprey variants December 6. This decision comes following a recent precautionary landing of a CV-22. There were no injuries to the crew,” he explained.

“The safety of our V-22 aircrew is our top priority. We are committed to ensuring our Sailors, Airmen, and Marines are able to successfully complete their missions and return home safely.”

The move comes after a V-22, operating out of the Air Force Special Operations Command (AFSOC) in Florida, was forced to make a “precautionary landing,” its spokesperson told us. No one was injured in the incident.

The decision comes barely a year after the last grounding of the V-22 fleet, which came after a fatal crash by a V-22 operated by the Air Force which killed both pilots and six passengers. The cause of that crash was reportedly one of the two engines failed, and the fleet was grounded for three months of checks.

The aircraft’s tiltrotor design, while offering significant advantages in terms of speed, range, and short or vertical lift-off capability, is also incredibly complicated. The aircraft has gained a reputation for unreliability, with four crashes and 30 fatalities occurring during the nine-year testing period, and one ex-pilot has claimed the design was rushed through testing.

Last month an investigation by the Associated Press reported that the top three most serious types of incidents for the aircraft were up to 46 percent between 2019 and 2023, despite the total number of flying hours falling. Overall safety issues were up 18 percent in the same period.

The report suggests that the complex design of the Boeing-Bell aircraft, and the stresses and strains of flight, are causing parts to wear out more quickly than expected. Most of the accidents reported were related to engine issues and last month’s incident may have been more serious than the military is saying, otherwise why ground the entire fleet?

Nevertheless, the military isn’t giving up on the design. In 2022 the winner of the military’s Future Long-Range Assault Aircraft was announced and it’s another tiltrotor design — the Bell V-280 Valor. That aircraft is designed to replace the Black Hawk transport helicopter and is forecast to fly in 2027 at the earliest. ®