Cleo Harmony MFT: Cl0p Data Theft at Vantex Logistics
A Cleo Harmony managed file transfer server in the Vantex Logistics DMZ started reaching external systems it does not normally contact and running processes the change record does not explain. Reconstruct what happened from the Cleo web logs, the Windows event logs, the resolver and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the entry point
15The managed file transfer server has started behaving unusually, reaching out to external systems it should not contact and generating unexpected process activity. Before building the timeline, establish exactly how an outside party was able to interact with the server at all.
Identify the initial exploit source
15The file write that triggered everything came from a specific external address. Identify it.
Name what was planted
15The write put something specific on disk in the processing directory. Identify the filename of the artifact that triggered execution when the Cleo service restarted.
Trace the loader back to its origin
20When the Cleo service restarted, it processed the file that had been placed there and launched a Java process. That process reached out to fetch its next stage. Identify the staging domain it contacted.
Find the exfiltration destination
20Hours after the initial compromise, the backdoor began streaming transfer files outbound. Identify the external IP that received the stolen data.
Classify the persistence mechanism
15Between the loader running and the transfers starting, the Cleo application records a session under an account no administrator provisioned. Classify what the adversary is doing with that credential and map it to MITRE ATT&CK.
Classify the initial access technique
10Map the root cause of the compromise to its MITRE ATT&CK initial access technique.
7 tasks · 110 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.