New Cleo zero-day RCE flaw exploited in data theft attacks

A zero-day bypass affecting Cleo managed file transfer products (LexiCom, VLTrader, Harmony) is being actively exploited to upload malicious files into autorun directories, execute PowerShell commands that fetch JAR payloads and deploy webshells, and exfiltrate data; evidence links activity to IPs across multiple countries and to the Termite ransomware group, and defenders are advised to restrict internet exposure, search for specific TXT/XML artifacts and JAR files, disable autorun, and apply forthcoming patches.