Threat Campaign Targeting Cleo MFT Products - Remediation Guidance

Arctic Wolf Labs observed an active campaign (first indications Oct 19, spike in Dec 2024) targeting Cleo MFT products (Harmony, VLTrader, LexiCom), where threat actors are suspected to leverage a remote code execution vulnerability (CVE-2024-50623) or similar flaws to run malicious PowerShell via the Autorun feature, drop and execute JAR payloads, and perform system reconnaissance; the bulletin provides detection context, mitigation steps (patching, disabling/hardening Autorun), and a list of suspicious files/IOCs to remove.