Week of December 9, 2024: Cleo Zero-Day Exploited, Krispy Kreme Discloses Cyber Incident

The week of December 9, 2024 brought a Krispy Kreme disclosure of a material cybersecurity incident alongside a fast-moving attack campaign against Cleo's managed file-transfer software that fed a ransomware operation. CISA added the exploited Cleo flaw to its Known Exploited Vulnerabilities Catalog, warned the water sector about internet-exposed operator interfaces, and Microsoft patched an actively exploited Windows zero-day, giving security leaders a dense patch and disclosure agenda to work through.

Krispy Kreme Disclosed Material Cybersecurity Incident

Krispy Kreme filed a Form 8-K on December 11, 2024 disclosing a cybersecurity incident involving unauthorized activity on a portion of its information technology systems, first identified on November 29, 2024. The company said online ordering in parts of the United States was disrupted while in-person shop sales and daily fresh deliveries continued uninterrupted. Krispy Kreme engaged external cybersecurity experts, notified federal law enforcement, and stated the incident was reasonably likely to have a material impact on its business operations and financial results, though cybersecurity insurance was expected to offset part of the related costs. (SEC EDGAR)

Cleo File-Transfer Zero-Day Exploited by Ransomware Actors

Cleo released version 5.8.0.24 of its Harmony, VLTrader, and LexiCom file-transfer products on December 11, 2024 to close a vulnerability that attackers had already been exploiting as a zero-day to breach internet-facing installations. Researchers at Huntress, Rapid7, and Sophos X-Ops tracked a multi-stage malware implant used after exploitation to establish reverse-shell connections, harvest system and domain information, and move laterally. More than 50 compromised hosts, largely retail organizations in North America, were identified, and the activity was linked to a ransomware group seeking extortion payments from affected file-transfer customers. (Help Net Security)

Microsoft Patched Exploited Windows CLFS Zero-Day

Microsoft's December 2024 Patch Tuesday, released December 10, 2024, resolved 71 vulnerabilities across its product line, including a Windows Common Log File System driver flaw, CVE-2024-49138, that attackers had already exploited in the wild to gain SYSTEM-level privileges. Researchers noted the flaw continued a pattern of CLFS driver bugs favored by ransomware operators for privilege escalation after initial code execution. Microsoft also patched a Windows LDAP remote code execution vulnerability, CVE-2024-49112, that required no authentication, prompting guidance to restrict Domain Controller internet access as an interim mitigation. (Help Net Security)

CISA Added Cleo Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2024-50623, an unrestricted file upload vulnerability affecting Cleo's LexiCom, VLTrader, and Harmony products, to its Known Exploited Vulnerabilities Catalog on December 13, 2024, citing evidence of active exploitation. The addition followed days of in-the-wild attacks against internet-facing Cleo servers that researchers had already connected to a ransomware campaign. Binding Operational Directive 22-01 required federal civilian agencies to remediate the flaw by a set deadline, and CISA urged all organizations to prioritize the fix as part of ongoing vulnerability management practices. (CISA)

CISA and EPA Warned Water Sector on Exposed HMIs

CISA and the Environmental Protection Agency released a joint fact sheet on December 13, 2024 addressing risks that internet-exposed human-machine interfaces pose to Water and Wastewater Systems facilities. The guidance explained that HMIs let operational technology staff read supervisory control and data acquisition systems tied to programmable logic controllers, and warned that threat actors exploiting exposed HMIs without adequate controls could force utilities into manual operations. The agencies recommended mitigations to harden remote access to HMIs and pointed WWS organizations to additional sector-specific resources. (CISA)

8Base Ransomware Group Claimed Attack on Croatian Port Operator

The 8Base ransomware group claimed an attack on Luka Rijeka, a Croatian company providing maritime transport, port, and storage services, listing stolen invoices, employment contracts, personal data, and accounting documents on its leak site. A company board member confirmed the intrusion was detected on November 30, 2024 and that IT staff shut down systems as a precaution, with full operations restored by December 2. The board member said no ransom demand had been received and that existing backups meant the incident caused no business damage. (Help Net Security)

Researchers Disclosed BadRAM Attack on AMD Encrypted Memory

Academic researchers from KU Leuven, the University of Lübeck, and the University of Birmingham disclosed BadRAM, tracked as CVE-2024-21944, a hardware vulnerability that let a modified memory module bypass AMD's Secure Encrypted Virtualization protections, including the latest SEV-SNP version. Using roughly $10 in equipment, including a Raspberry Pi Pico, the team showed it was possible to fake remote attestation reports and insert backdoors into SEV-protected virtual machines. AMD issued firmware updates, tracked as AMD-SB-3015, to validate memory configurations during boot, and most cloud providers had already applied the fix. (Help Net Security)