Blog
/
Network
/
December 16, 2024

Cleo File Transfer Vulnerability: Patch Pitfalls and Darktrace’s Detection of Post-Exploitation Activities

File transfer applications are prime targets for ransomware groups due to their critical role in business operations. Recent vulnerabilities in Cleo's MFT software, namely CVE-2024-50623 and CVE-2024-55956, highlight ongoing risks. Read more about the Darktrace Threat Research team’s investigation into these vulnerabilities.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
16
Dec 2024

File transfer applications: A target for ransomware

File transfer applications have been a consistent target, particularly for ransomware groups, in recent years because they are key parts of business operations and have trusted access across different parts of an organization that include potentially confidential and personal information about an organization and its employees.

Recent targets of ransomware criminals includes applications like Acellion, Moveit, and GoAnywhere [1]. This seems to have been the case for Cleo’s managed file transfer (MFT) software solutions and the vulnerability CVE-2024-50623.

Threat overview: Understanding Cleo file transfer vulnerability

This vulnerability was believed to have been patched with the release of version 5.8.0.21 in late October 2024. However, open-source intelligence (OSINT) reported that the Clop ransomware group had managed to bypass the initial patch in late November, leading to the successful exploitation of the previously patched CVE.

In the last few days Cleo has published a new vulnerability, CVE-2024-55956, which is not a patch bypass of the CVE-2024-50623 but rather another vulnerability. This is also an unauthenticated file write vulnerability but while CVE-2024-50623 allows for both reading and writing arbitrary files, the CVE-2024-55956 only allows for writing arbitrary files and was addressed in version 5.8.0.24 [2].

Darktrace Threat Research analysts have already started investigating potential signs of devices running the Cleo software with network traffic supporting this initial hypothesis.

Comparison of CVE-2024-50623 and CVE-2024-55956

While CVE-2024-50623 was initially listed as a cross-site scripting issue, it was updated on December 10 to reflect unrestricted file upload and download. This vulnerability could lead to remote code execution (RCE) in versions of Cleo’s Harmony, VLTrader, and LexiCom products prior to 5.8.0.24. Attackers could leverage the fact that files are placed in the "autorun" sub-directory within the installation folder and are immediately read, interpreted, and evaluated by the susceptible software [3].

CVE-2024-55956, refers to an unauthenticated user who can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory [4]. Both CVEs have occurred due to separate issues in the “/Synchronization” endpoint.

Investigating post exploitation patterns of activity on Cleo software

Proof of exploitation

Darktrace’s Threat Research analysts investigated multiple cases where devices identified as likely running Cleo software were detected engaging in unusual behavior. Analysts also attempted to identify any possible association between publicly available indicators of compromise (IoCs) and the exploitation of the vulnerability, using evidence of anomalous network traffic.

One case involved an Internet-facing device likely running Cleo VLTrader software (based on its hostname) reaching out to the 100% rare Lithuanian IP 181.214.147[.]164 · AS 15440 (UAB Baltnetos komunikacijos).

This activity occurred in the early hours of December 8 on the network of a customer in the energy sector. Darktrace detected a Cleo server transferring around over 500 MB of data over multiple SSL connections via port 443 to the Lithuanian IP. External research reported that this IP appears to be a callback IP observed in post-exploitation activity of vulnerable Cleo devices [3].

While this device was regularly observed sending data to external endpoints, this transfer represented a small increase in data sent to public IPs and coupled with the rarity of the destination, triggered a model alert as well as a Cyber AI Analyst Incident summarizing the transfer. Unfortunately, due to the encrypted connection no further analysis of the transmitted data was possible. However, due to the rarity of the activity, Darktrace’s Autonomous Response intervened and prevented any further connections to the IP.

 Model Alert Event Log show repeated connections to the rare IP, filtered with the rarity metric.
Figure 1: Model Alert Event Log show repeated connections to the rare IP, filtered with the rarity metric.
Shows connections to 181.214.147[.]164 and the amount of data transferred.
Figure 2: Shows connections to 181.214.147[.]164 and the amount of data transferred.

On the same day, external connections were observed to the external IP 45.182.189[.]225, along with inbound SSL connections from the same endpoint. OSINT has also linked this IP to the exploitation of Cleo software vulnerabilities [5].

Outgoing connections from a Cleo server to an anomalous endpoint.
Figure 3: Outgoing connections from a Cleo server to an anomalous endpoint.
 Incoming SSL connections from the external IP 45.182.189[.]225.
Figure 4: Incoming SSL connections from the external IP 45.182.189[.]225.

Hours after the last connection to 181.214.147[.]164, the integration detection tool from CrowdStrike, which the customer had integrated with Darktrace, issued an alert. This alert provided additional visibility into host-level processes and highlighted the following command executed on the Cleo server:

“D:\VLTrader\jre\bin\java.exe" -jar cleo.4889

Figure 5: The executed comand “D:\VLTrader\jre\bin\java.exe" -jar cleo.4889 and the Resource Location: \Device\HarddiskVolume3\VLTrader\jre\bin\java.exe.

Three days later, on December 11, another CrowdStrike integration alert was generated, this time following encoded PowerShell command activity on the server. This is consistent with post-exploitation activity where arbitrary PowerShell commands are executed on compromised systems leveraging the default settings of the Autorun directory, as highlighted by Cleo support [6]. According to external researchers , this process initiates connections to an external IP to retrieve JAR files with webshell-like functionality for continued post-exploitation [3]. The IP embedded in both commands observed by Darktrace was 38.180.242[.]122, hosted on ASN 58061(Scalaxy B.V.). There is no OSINT associating this IP with Cleo vulnerability exploitation at the time of writing.

Another device within the same customer network exhibited similar data transfer and command execution activity around the same time, suggesting it had also been compromised through this vulnerability. However, this second device contacted a different external IP, 5.45.74[.]137, hosted on AS 58061 (Scalaxy B.V.).

Like the first device, multiple connections to this IP were detected, with almost 600 MB of data transferred over the SSL protocol.

The Security Integration Detection Model that was triggered  and the PowerShell command observed
Figure 6: The Security Integration Detection Model that was triggered  and the PowerShell command observed
 Incoming connections from the external IP 38.180.242[.]122.
Figure 7: Incoming connections from the external IP 38.180.242[.]122.
Connections to the external IP 5.45.74[.]137.
Figure 8: Connections to the external IP 5.45.74[.]137.
Figure 9: Autonomous Response Actions triggered during the suspicious activities

While investigating potential Cleo servers involved in similar outgoing data activity, Darktrace’s Threat Research team identified two additional instances of likely Cleo vulnerability exploitation used to exfiltrate data outside the network. In those two instances, unusual outgoing data transfers were observed to the IP 176.123.4[.]22 (AS 200019, AlexHost SRL), with around 500 MB of data being exfiltrated over port 443 in one case (the exact volume could not be confirmed in the other instance). This IP was found embedded in encoded PowerShell commands examined by external researchers in the context of Cleo vulnerability exploitation investigations.

Conclusion

Overall, Cleo software represents a critical component of many business operations, being utilized by over 4,000 organizations worldwide. This renders the software an attractive target for threat actors who aim at exploiting internet-facing devices that could be used to compromise the software’s direct users but also other dependent industries resulting in supply chain attacks.

Darktrace / NETWORK was able to capture traffic linked to exploitation of CVE-2024-50623 within models that triggered such as Unusual Activity / Unusual External Data to New Endpoint while its Autonomous Response capability successfully blocked the anomalous connections and exfiltration attempts.

Information on new CVEs, how they're being exploited, and whether they've been patched can be fast-changing, sometimes limited and often confusing. Regardless, Darktrace is able to identify and alert to unusual behavior on these systems, indicating exploitation.

Credit to Maria Geronikolou, Alexandra Sentenac, Emma Fougler, Signe Zaharka and the Darktrace Threat Research team

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

  • Identity-based attacks: How attackers are bypassing traditional defenses
  • Zero-day exploitation: The rise of previously unknown vulnerabilities
  • AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

Appendices

References

[1] https://blog.httpcs.com/en/file-sharing-and-transfer-software-the-new-target-of-hackers/

[2] https://attackerkb.com/topics/geR0H8dgrE/cve-2024-55956/rapid7-analysis

[3] https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

[4] https://nvd.nist.gov/vuln/detail/CVE-2024-55956

[5] https://arcticwolf.com/resources/blog/cleopatras-shadow-a-mass-exploitation-campaign/

[6] https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending

[7] https://support.cleo.com/hc/en-us/articles/360034260293-Local-HTTP-Users-Configuration

Darktrace Model Alerts

Anomalous Connection / Data Sent to Rare Domain

Unusual Activity / Unusual External Data to New Endpoint

Unusual Activity / Unusual External Data Transfer

Device / Internet Facing Device with High Priority Alert

Anomalous Server Activity / Rare External from Server

Anomalous Connection / New User Agent to IP Without Hostname

Security Integration / High Severity Integration Incident

Security Integration / Low Severity Integration Detection

Autonomous Response Model Detections

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

Cyber AI Analyst Incidents

Unusual External Data Transfer

MITRE ATT&CK Mapping

Tactic – Technique

INITIAL ACCESS – Exploit Public-Facing Application

COMMAND AND CONTROL – Application Layer Protocol (Web Protocols)

COMMAND AND CONTROL – Encrypted Channel

PERSISTENCE – Web Shell

EXFILTRATION - Exfiltration Over C2 Channel

IoC List

IoC       Type    Description + Probability

181.214.147[.]164      IP Address       Likely C2 Infrastructure

176.123.4[.]22            IP Address       Likely C2 Infrastructure

5.45.74[.]137               IP Address           Possible C2 Infrastructure

38.180.242[.]122        IP Address       Possible C2 Infrastructure

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst

More in this series

No items found.

Blog

/

/

April 22, 2025

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

man looking at multiple computer screensDefault blog imageDefault blog image

Out of all the services honeypotted by Darktrace, Docker is the most commonly attacked, with new strains of malware emerging daily. This blog will analyze a novel malware campaign with a unique obfuscation technique and a new cryptojacking technique.

What is obfuscation?

Obfuscation is a common technique employed by threat actors to prevent signature-based detection of their code, and to make analysis more difficult. This novel campaign uses an interesting technique of obfuscating its payload.

Docker image analysis

The attack begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. Using Docker Hub’s layer viewer, an analyst can quickly identify what the container is designed to do. In this case, the container is designed to run the ten.py script which is built into itself.

 Docker Hub Image Layers, referencing the script ten.py.
Figure 1: Docker Hub Image Layers, referencing the script ten.py.

To gain more information on the Python file, Docker’s built in tooling can be used to download the image (docker pull kazutod/tene:ten) and then save it into a format that is easier to work with (docker image save kazutod/tene:ten -o tene.tar). It can then be extracted as a regular tar file for further investigation.

Extraction of the resulting tar file.
Figure 2: Extraction of the resulting tar file.

The Docker image uses the OCI format, which is a little different to a regular file system. Instead of having a static folder of files, the image consists of layers. Indeed, when running the file command over the sha256 directory, each layer is shown as a tar file, along with a JSON metadata file.

Output of the file command over the sha256 directory.
Figure 3: Output of the file command over the sha256 directory.

As the detailed layers are not necessary for analysis, a single command can be used to extract all of them into a single directory, recreating what the container file system would look like:

find blobs/sha256 -type f -exec sh -c 'file "{}" | grep -q "tar archive" && tar -xf "{}" -C root_dir' \;

Result of running the command above.
Figure 4: Result of running the command above.

The find command can then be used to quickly locate where the ten.py script is.

find root_dir -name ten.py

root_dir/app/ten.py

Details of the above ten.py script.
Figure 5: Details of the above ten.py script.

This may look complicated at first glance, however after breaking it down, it is fairly simple. The script defines a lambda function (effectively a variable that contains executable code) and runs zlib decompress on the output of base64 decode, which is run on the reversed input. The script then runs the lambda function with an input of the base64 string, and then passes it to exec, which runs the decoded string as Python code.

To help illustrate this, the code can be cleaned up to this simplified function:

def decode(input):
   reversed = input[::-1]

   decoded = base64.decode(reversed)
   decompressed = zlib.decompress(decoded)
   return decompressed

decoded_string = decode(the_big_text_blob)
exec(decoded_string) # run the decoded string

This can then be set up as a recipe in Cyberchef, an online tool for data manipulation, to decode it.

Use of Cyberchef to decode the ten.py script.
Figure 6: Use of Cyberchef to decode the ten.py script.

The decoded payload calls the decode function again and puts the output into exec. Copy and pasting the new payload into the input shows that it does this another time. Instead of copy-pasting the output into the input all day, a quick script can be used to decode this.

The script below uses the decode function from earlier in order to decode the base64 data and then uses some simple string manipulation to get to the next payload. The script will run this over and over until something interesting happens.

# Decode the initial base64

decoded = decode(initial)
# Remove the first 11 characters and last 3

# so we just have the next base64 string

clamped = decoded[11:-3]

for i in range(1, 100):
   # Decode the new payload

   decoded = decode(clamped)
   # Print it with the current step so we

   # can see what’s going on

   print(f"Step {i}")

   print(decoded)
   # Fetch the next base64 string from the

   # output, so the next loop iteration will

   # decode it

   clamped = decoded[11:-3]

Result of the 63rd iteration of this script.
Figure 7: Result of the 63rd iteration of this script.

After 63 iterations, the script returns actual code, accompanied by an error from the decode function as a stopping condition was never defined. It not clear what the attacker’s motive to perform so many layers of obfuscation was, as one round of obfuscation versus several likely would not make any meaningful difference to bypassing signature analysis. It’s possible this is an attempt to stop analysts or other hackers from reverse engineering the code. However,  it took a matter of minutes to thwart their efforts.

Cryptojacking 2.0?

Cleaned up version of the de-obfuscated code.
Figure 8: Cleaned up version of the de-obfuscated code.

The cleaned up code indicates that the malware attempts to set up a connection to teneo[.]pro, which appears to belong to a Web3 startup company.

Teneo appears to be a legitimate company, with Crunchbase reporting that they have raised USD 3 million as part of their seed round [1]. Their service allows users to join a decentralized network, to “make sure their data benefits you” [2]. Practically, their node functions as a distributed social media scraper. In exchange for doing so, users are rewarded with “Teneo Points”, which are a private crypto token.

The malware script simply connects to the websocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping. Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works [2].

Checking out the attacker’s dockerhub profile, this sort of attack seems to be their modus operandi. The most recent container runs an instance of the nexus network client, which is a project to perform distributed zero-knowledge compute tasks in exchange for cryptocurrency.

Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto. Whether this is more profitable remains to be seen. There is not currently an easy way to determine the earnings of the attackers due to the more “closed” nature of the private tokens. Translating a user ID to a wallet address does not appear to be possible, and there is limited public information about the tokens themselves. For example, the Teneo token is listed as “preview only” on CoinGecko, with no price information available.

Conclusion

This blog explores an example of Python obfuscation and how to unravel it. Obfuscation remains a ubiquitous technique employed by the majority of malware to aid in detection/defense evasion and being able to de-obfuscate code is an important skill for analysts to possess.

We have also seen this new avenue of cryptominers being deployed, demonstrating that attackers’ techniques are still evolving - even tried and tested fields. The illegitimate use of legitimate tools to obtain rewards is an increasingly common vector. For example,  as has been previously documented, 9hits has been used maliciously to earn rewards for the attack in a similar fashion.

Docker remains a highly targeted service, and system administrators need to take steps to ensure it is secure. In general, Docker should never be exposed to the wider internet unless absolutely necessary, and if it is necessary both authentication and firewalling should be employed to ensure only authorized users are able to access the service. Attacks happen every minute, and even leaving the service open for a short period of time may result in a serious compromise.

References

1. https://www.crunchbase.com/funding_round/teneo-protocol-seed--a8ff2ad4

2. https://teneo.pro/

Continue reading
About the author
Nate Bill
Threat Researcher

Blog

/

/

April 22, 2025

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

woman looking out at buildingsDefault blog imageDefault blog image

Modern networks are evolving rapidly, with traffic patterns, user behavior, and critical assets extending far beyond the boundaries of traditional network security tools. As organizations adopt hybrid infrastructures, remote working, and cloud-native services, it is essential to maintain visibility and protect this expanding attack surface.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) are two technologies commonly used to safeguard organizational networks. While both play crucial roles in enhancing security, one does not replace the other. Instead, NDR and SASE complement each other, taking on different roles to create a robust network security framework. This blog will unpack the relationship between NDR and SASE, including the component functionalities that comprise SASE, highlighting their unique contributions to maintaining a comprehensive and resilient network security strategy.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) explained

NDR solutions, such as Darktrace / NETWORK, are designed to detect, investigate, and respond to suspicious activities within any network. By leveraging machine learning and behavioral analytics, NDR continuously monitors network traffic to identify anomalies that could indicate potential threats and to contain those threats at machine speed. These solutions analyze both North-South traffic (between internal and external networks) and East-West traffic (within internal networks), providing comprehensive visibility into network activities.

SASE, on the other hand, comprises multiple solutions, focused on providing hybrid and remote users access to services while adhering to the Zero Trust principle of "never trust, always verify". Within SASE architectures, Zero Trust Network Access (ZTNA) solutions provide secure remote access to private applications and services the user has been explicitly granted, and Secure Web Gateways (SWG) provide Internet access, again based on policy groups. Unlike traditional security models that grant implicit trust to users within the network perimeter, ZTNA requires continuous verification of user identity and device health before granting access to resources. This approach minimizes the attack surface and reduces the risk of unauthorized access to sensitive data and internal applications. Similarly, SWGs filter web traffic based on the verified user identity and can block known malware, further reducing the attack surface for the client estate.

Limitations of SASE highlights the importance of NDR

While SASE, including ZTNA and SWG, is a powerful tool for enforcing secure access to company networks and resources as well as the Internet, it is not a comprehensive security solution, or a replacement for dedicated network monitoring and NDR capabilities. Some of the main limitations include:

  • Focused on policies rather than security: SASE delivers strong networking outcomes but provides policy-based protections, rather than a full suite of security features. It can provide simple alerting for disallowed actions, but it lacks the security context needed for comprehensive threat detection, such as knowing if user credentials have been compromised.
  • Can only detect known threats: SASE solutions cannot detect novel attacks such as zero-days and insider threats. This is because they rely on a rule-based approach that does not have a behavioral understanding of network entities that can detect anomalies or suspicious activity.
  • Limited response capabilities: Due to the limited detection capabilities of SASE solutions, it is not possible to automate response actions to threats that slip past existing policies.  While access to internal resources and the Internet can be revoked or severely limited as part of a response, this must be done after human investigation and analysis, allowing more time for the threat to continue before being contained.
  • Limited scope: SASE provides cloud-hosted secure networking, which lends itself much more toward the client estate of any organization. As a result, servers and unmanaged devices—whether IT/IoT/OT—are mostly out of scope and do not benefit from the policies SASE enforces.

The complementary roles of NDR and ZTNA

NDR solutions provide full visibility into network activity, with the ability to detect and respond to threats that may bypass initial access controls and filters. When combined, NDR and SASE create a layered security approach that addresses different aspects of network security, for example:

  • Detection of novel, unknown and insider threats: NDR solutions can monitor all network traffic using behavioral anomaly detection. This can identify suspicious activities, such as insider threats from authorized users who have passed policy checks, or novel attacks that have never been seen before.
  • Validation of policies: By continuously monitoring network traffic, NDR can validate the effectiveness of existing policies and identify any gaps in security that need addressing due to organizational changes or outdated rule sets.
  • Reducing risk and impact of threats: Together, SASE and NDR solutions shift toward proactive security by reducing the potential impact of a threat through predefined policies and by detecting and containing a threat in its earliest stages, even if it is novel or nuanced.
  • Enhanced contextual information: Alerts raised by SASE solutions can provide additional context into potential threats, which can be used by NDR solutions to increase investigation quality and context.
  • Containment of network threats: SASE solutions can prohibit access to resources on an internal company network or on the Internet if predefined access control criteria are not met or a site matches a threat signature. When combined with an NDR solution, organizations can go far beyond this, detecting and responding to a much wider variety of network threats to prevent attacks from escalating.

When implementing SASE and NDR solutions, it is also crucial to consider the best configurations to maximize interoperability, and integrations will often increase functionality. Well-designed implementations, combined with integrations, will strengthen both SASE and NDR solutions for organizations.

How Darktrace continues to secure SASE networks

With the latest 6.3 update, Darktrace continues to extend its capabilities with new innovations that support modern enterprise networks and the use of SASE across remote and hybrid worker devices. This expands on existing Darktrace integrations and partnerships with SASE vendors such as Netskope and Zscaler.

Traditional methods to contain remote access and internet-born threats are either signature or policy based, and response to nuanced threats requires manual, human-led investigation and decision-making. By the time security teams can react, the damage is often already done.

With Darktrace 6.3, customers using Zscaler can now configure Darktrace Autonomous Response to quarantine ZPA-connected user devices at machine speed. This provides a powerful new mechanism for containing remote threats at the earliest sign of suspicious activity, without disrupting broader operations.

By automatically shutting down ZPA access for compromised user accounts, Darktrace gives SOC teams valuable time to investigate and respond, while continuing to protect the rest of the organization. This integration enhances Darktrace’s ability to take actions for remote user devices, helping customers contain threats faster and keep the business running smoothly.

For organizations using SASE technologies to address the challenges of securing large, distributed networks across a range of geographies, SaaS applications and remote worker devices, Darktrace also now integrates with Netskope Cloud TAP to provide visibility into and analysis over tunneled traffic, reducing blind spots and enabling organizations to maintain detection capabilities across their expanding network perimeters.

Conclusion

While NDR and ZTNA serve distinct purposes, their integration is crucial for a comprehensive security strategy. ZTNA provides robust access controls, ensuring that only authorized users can access network resources. NDR, on the other hand, offers continuous visibility into network activities, detecting and responding to threats that may bypass initial access controls. By leveraging the strengths of both solutions, organizations can enhance their security posture and protect against a wide range of network security threats.

Understanding the complementary roles of NDR and ZTNA is essential for building a resilient security framework. As cyber threats continue to evolve, adopting a multi-layered, defense-in-depth security approach will be key to safeguarding organizational networks.

Click here for more information about the latest product innovations in Darktrace 6.3, or learn more about Darktrace / NETWORK here.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI