Clop ransomware claims responsibility for Cleo data theft attacks

Clop has claimed responsibility for recent data-theft attacks exploiting two Cleo managed-file-transfer zero-days (CVE-2024-50623 and CVE-2024-55956) that allowed unauthenticated file writes and remote code execution; attackers deployed a Java backdoor called Malichus to steal data and move laterally. Multiple vendors and researchers (Huntress, Rapid7) and CISA have confirmed exploitation in the wild, fixes have been released for Cleo products, and Clop continues to post extortion content while stating it will delete some previously posted data.