Cleo MFT Zero-Day Exploits Are About Escalate, Analysts Warn

An active ransomware campaign is exploiting an insufficiently patched zero-day (CVE-2024-50623) in Cleo managed file transfer products; a public proof-of-concept and active intrusions (at least 10 customers) have been reported. The attack chain uses a PowerShell stager to deploy a Java-based 'Cleopatra' backdoor (cross-platform) linked to the 'Termite' ransomware group, and patching confusion has left many instances exposed, raising the risk of widespread mass exploitation similar to MOVEit incidents.