Cleo Software Actively Being Exploited in the Wild | Huntress

What it is

Huntress threat advisory on active mass exploitation of an arbitrary file-write flaw in Cleo's LexiCom, VLTrader, and Harmony managed file-transfer software (CVE-2024-55956, distinct from the earlier CVE-2024-50623). The critical finding: the existing patch, version 5.8.0.21, does not fix the flaw. Huntress recreated a working proof of concept against 5.8.0.21, and Cleo confirmed the recreated attack chain over a Zoom call on December 9.

How it works

The primitive lets an unauthenticated attacker write files anywhere on disk. The chain abuses Cleo's native autorun folder, whose contents are immediately read, evaluated, then deleted:

1. Attacker writes autorun\healthchecktemplate.txt (also seen: autorun\healthcheck.txt).
2. That file invokes Cleo's native Import functionality against a dropped .tmp file in temp\ — actually a ZIP containing hosts\main.xml.
3. main.xml (bearing a decoy 2020/10/10 00:00:00 timestamp) stages a further autorun that launches an encoded PowerShell command.
4. PowerShell fetches JAR files from an external IP; the JARs provide webshell-like persistence. Attackers later delete the JARs to stay stealthy.
5. Follow-on AD reconnaissance uses nltest.exe.

Preconditions / Affected

Internet-exposed Cleo Harmony, VLTrader, or LexiCom, all versions up to and including 5.8.0.21 — including fully patched systems. Default installs sit at C:\LexiCom, C:\VLTrader, C:\Harmony, or under C:\Program Files (x86).

What to do

No fixing patch existed at time of writing. Huntress's mitigation is to move internet-exposed Cleo systems behind a firewall until a new patch ships.

Detection artifacts the page names:

• autorun\healthchecktemplate.txt or autorun\healthcheck.txt (deleted after processing, so check logs, not just disk).
• In logs\LexiCom.xml, Import events loading a temp\*.tmp file.
• In LexiCom.dbg, lines such as:

LexiCom.syncer [redacted] Request In <<< Multipart:
 VLSync:SentReceipt;service=AS2;path="autorun/healthchecktemplate.txt"

• nltest.exe spawned in an unusual parent-child chain.

Callback IPs to hunt/block:

176.123.5.126
5.149.249.226
185.181.230.103
209.127.12.38
181.214.147.164
192.119.99.42

Caveats

Huntress could not recover the contents of the healthchecktemplate.txt / healthcheck.txt autoruns because Cleo auto-deletes them. Exploitation was confirmed as early as December 3 with a sharp uptick December 8 ~07:00 UTC; at least 10 businesses were compromised, mostly in consumer products, food, trucking, and shipping, and Huntress notes others outside its visibility are likely affected. The blog was being updated as details emerged, so version and patch status may have changed after publication.