Huntress researchers analyzed the Malichus malware family delivered via exploitation of CVE-2024-55956, a zero-day vulnerability in Cleo file transfer software. The malware operates in three stages: a PowerShell downloader, a Java-based second-stage downloader using AES decryption, and a modular Java post-exploitation framework. The final stage includes 9 class files supporting interactive shell access, file exfiltration via zip archiving, Cleo configuration parsing, and a fully custom C2 protocol with 13 packet types and rolling-state encryption. The framework targets both Windows and Linux but was observed only on Windows. IOCs, YARA rules, and full packet structure details are provided.
