Cleo MFT Exploitation: Cl0p Data Theft (CVE-2024-50623)

A Cleo Harmony managed file transfer server is compromised through an unauthenticated file-write vulnerability in its autorun directory (CVE-2024-55956). When the service restarts, the planted XML triggers a Java loader that stages a backdoor, provisions a rogue account, and streams stored transfer files to external infrastructure. Reconstruct the chain from the Cleo web logs, Windows event logs, and perimeter firewall.