Cleo Harmony MFT: Cl0p Data Theft at Vantex Logistics
A Cleo Harmony managed file transfer server in the Vantex Logistics DMZ started reaching external systems it does not normally contact and running processes the change record does not explain. Reconstruct what happened from the Cleo web logs, the Windows event logs, the resolver and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the entry point
15The managed file transfer server has started behaving unusually, reaching out to external systems it should not contact and generating unexpected process activity. Before building the timeline, establish exactly how an outside party was able to interact with the server at all.
Identify the initial exploit source
15The file write that triggered everything came from a specific external address. Identify it.
Name what was planted
15The write put something specific on disk in the processing directory. Identify the filename of the artifact that triggered execution when the Cleo service restarted.
Trace the loader back to its origin
20When the Cleo service restarted, it processed the file that had been placed there and launched a Java process. That process reached out to fetch its next stage. Identify the staging domain it contacted.
Find the exfiltration destination
20Hours after the initial compromise, the backdoor began streaming transfer files outbound. Identify the external IP that received the stolen data.
Classify the persistence mechanism
15Between the loader running and the transfers starting, the Cleo application records a session under an account no administrator provisioned. Classify what the adversary is doing with that credential and map it to MITRE ATT&CK.
Classify the initial access technique
10Map the root cause of the compromise to its MITRE ATT&CK initial access technique.
7 tasks · 110 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allIvanti Connect Secure: Auth Bypass to Webshell
An internet-facing Ivanti Connect Secure VPN appliance has been exploited through a pair of chained zero-days: an authentication bypass and a command injection. A webshell is now resident on the appliance, credentials have been stolen from the system configuration, and the attacker has pivoted inward. Work from the SIEM access logs, the Linux host audit trail, and the XDR process tree to reconstruct the chain from the first bypass request to the internal pivot.
Zimbra Webmail RCE: Archive Exploit to Mailbox Theft
A law firm Zimbra Collaboration server was compromised through a path traversal flaw in the cpio helper invoked during inbound email scanning (CVE-2022-41352). A crafted archive delivered over SMTP caused cpio to drop a JSP webshell directly into the Zimbra web root, giving the actor persistent server-side execution. They then used Zimbra's own CLI tooling to export targeted attorney mailboxes and exfiltrate the data. Reconstruct the chain from the mail delivery through the webshell activity to the data leaving the network.
Jenkins Arbitrary File Read: CVE-2024-23897 to RCE
The Jenkins controller at Vetrina Systems is running a version vulnerable to CVE-2024-23897 -- an args4j parser flaw that lets the CLI read any file from the server filesystem before authentication completes. An attacker used it to steal the Jenkins master key and credential store, decrypted stored service-account passwords offline, then authenticated and ran Groovy code through the Script Console to drop a persistent payload and pivot to connected build agents. Work from the SIEM access logs and XDR process evidence to trace every step from the first CLI probe to the reverse shell.