Clop Returns Through Managed File Transfer: The Cleo Exploitation Campaign

In December 2024, attackers began exploiting vulnerabilities in Cleo’s managed file transfer products, and the Clop extortion group claimed responsibility for the resulting data theft. It was a familiar playbook: target a widely used file transfer platform, exploit a flaw before defenders can patch, steal data in bulk, and extort victims by threatening to publish it.

A pattern, not a coincidence

Clop has repeatedly targeted managed file transfer software, and for good reason. These systems exist to move sensitive files between organizations, so they are internet-facing, trusted, and packed with exactly the data an extortionist wants. This is data-theft extortion, not classic encryption ransomware, which changes how you defend and respond.

How to reduce your exposure

• Inventory your file transfer tools and treat them as critical, internet-facing assets.
• Minimize data at rest, so delivered files do not linger indefinitely.
• Plan for extortion, not just encryption.

Takeaway: Data-theft extortion cannot be undone with a backup. Keep file transfer platforms patched, keep as little data on them as possible, and watch for large outbound transfers.