Enterprise software maker Cleo on Wednesday released updates for several file transfer tools to patch an actively exploited vulnerability. In the meantime, security firms are conducting an analysis of the flaw, as well as the malware delivered by threat actors in the observed attacks.

An improperly patched vulnerability affecting Cleo’s Harmony, VLTrader, and LexiCom file transfer tools, which the vendor attempted to fix in late October, has been exploited in the wild since at least December 3. 

The initial security hole is tracked as CVE-2024-50623, but Cleo is working on assigning a new CVE. The vulnerability allows unauthenticated attackers to conduct unrestricted file uploads and downloads, and exploitation can lead to remote code execution.

Security firms such as Huntress, Rapid7 and Sophos have reported seeing in-the-wild exploitation against enterprises, including in the retail, food, and shipping industries. 

Cleo has been scrambling to release patches since the news of exploitation broke and late on Wednesday the company announced the release of Harmony, VLTrader, and LexiCom version 5.8.0.24, which should patch the vulnerability.

“Cleo strongly advises all customers to immediately upgrade instances of Harmony, VLTrader, and LexiCom to the latest released patch (version 5.8.0.24) to address additional discovered potential attack vectors of the vulnerability,” the vendor said.

It added in release notes, “After applying the patch, errors are logged for any files found at startup related to this exploit, and those files are removed.”

Huntress has confirmed that version 5.8.0.24 does appear to effectively patch the vulnerability, but the security firm has only tested it against its proof-of-concept (PoC) and has not analyzed the code.

Some reports claim that a new ransomware group known as Termite is behind the attacks, but given that more and more technical information has become available and given that hundreds of potentially vulnerable systems are exposed to the internet it’s possible that multiple threat actors are exploiting the vulnerability. 

The attackers’ end goal has not been confirmed, but since they can likely gain full control of the targeted server it’s believed that their most likely goal is the theft of sensitive information from organizations that use the Cleo products.

There have been some rumors that the recent Blue Yonder attack, which hit Starbucks and major grocery chains and for which the Termite ransomware group has taken credit, may have involved exploitation of the Cleo vulnerability. Termite on Wednesday released dozens of gigabytes of files allegedly stolen from Blue Yonder — the cybercriminals claim to have stolen 680 Gb of information. 

The incident is reminiscent of the MOVEit hack campaign, which involved the Cl0p ransomware group exploiting a zero-day in Progress Software’s MOVEit file transfer software to steal vast amounts of information from thousands of organizations.   

On Wednesday, security firm WatchTowr has released details on its technical analysis of CVE-2024-50623.      

Also on Wednesday, Huntress, Rapid7 and Binary Defense individually published an analysis of the malware used in the attacks, without attributing it to any threat groups. 

The final payload has been described as a Java-based post-exploitation framework and remote access trojan (RAT) that enables the attackers to conduct reconnaissance, execute commands, and exfiltrate files. The malware is also responsible for encrypted command and control (C&C) communications.

Related: Microsoft Ships Urgent Patch for Exploited Windows CLFS Zero-Day

Related: Ivanti Patches Critical Flaws in Connect Secure, Cloud Services Application

Related: Atlassian, Splunk Patch High-Severity Vulnerabilities