Clop is back to wreak havoc via vulnerable file-transfer software

Clop-affiliated threat actors have actively exploited critical vulnerabilities in Cleo’s LexiCom, VLTrader, and Harmony file-transfer products (notably CVE-2024-50623 and CVE-2024-55956), leading to confirmed compromises, published stolen data on a leak site, and vendor patches; multiple security firms (Huntress, Rapid7) and CISA report active exploitation and potential post-compromise activity consistent with extortion/ransomware tactics, raising concern given Clop’s prior large-scale MOVEit campaign.