#cl0p

Analysis · May 8, 2026 · The Field Notes Desk

Cleo shipped a fix in October. Cl0p was bypassing it by December.

CVE-2024-50623 was patched in 5.8.0.21 on October 27. By December 3, Huntress had a working PoC against fully patched hosts and Cl0p was running it in production. This is the fifth MFT vendor in five years to hand Cl0p the same playbook.