{"id":57877,"date":"2024-12-16T23:50:51","date_gmt":"2024-12-16T23:50:51","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/ransomware-scum-blow-holes-in-cleo-software-patches-cl0p-sort-of-claims-responsibility\/"},"modified":"2024-12-16T23:50:51","modified_gmt":"2024-12-16T23:50:51","slug":"ransomware-scum-blow-holes-in-cleo-software-patches-cl0p-sort-of-claims-responsibility","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-scum-blow-holes-in-cleo-software-patches-cl0p-sort-of-claims-responsibility\/","title":{"rendered":"Ransomware scum blow holes in Cleo software patches, Cl0p (sort of) claims responsibility"},"content":{"rendered":"

Supply chain integration vendor Cleo has urged its customers to upgrade three of its products after an October security update was circumvented, leading to widespread ransomware attacks that Russia-linked gang Cl0p has claimed are its evil work.<\/p>\n

This story starts in October when Cleo patched its Harmony, VLTrader, and LexiCom products to address an unrestricted file upload and download flaw that could lead to remote code execution (RCE).<\/p>\n

But last week infosec outfit Huntress warned<\/a> that Cleo’s products were under attack after the patches were bypassed. Huntress’s researchers advised<\/a> that mass exploitation was occurring, at least ten businesses had been compromised, and even fully patched systems were exploitable.<\/p>\n