Cleo Malichus Malware Analysis CVE-2024-55956| Huntress

This report analyzes "Malichus," a modular Java-based backdoor actively delivered by exploitation of a Cleo software zero-day (CVE-2024-55956). Huntress documents a three-stage chain—PowerShell loader, AES-encrypted Java downloader, and a multi-class Java post-exploitation framework with custom C2, file exfiltration, and interactive shell capabilities—providing technical details, custom C2 protocol description, IOCs (filenames and SHA256s) and links to YARA rules to support detection and mitigations.