Cleopatra’s Shadow: A Mass Exploitation Campaign Deploying a Java Backdoor Through Zero-Day Exploitation of Cleo MFT Software

Arctic Wolf Labs observed an ongoing mass exploitation campaign targeting Cleo MFT products that leverages the autorun feature to drop obfuscated PowerShell/Bash stagers which fetch a Java loader and ultimately deploy a cross-platform Java backdoor called 'Cleopatra'; the report provides timeline, technical analysis of the stager/loader/backdoor, IoCs (multiple C2 IPs, filenames, SHA256), TTP mappings, and detection and remediation recommendations including patching to Cleo 5.8.0.24 and monitoring for obfuscated PowerShell activity.