---
title: "Cleo Malichus Malware Analysis CVE-2024-55956"
url: https://daily.dev/posts/cleo-malichus-malware-analysis-cve-2024-55956-kpvof3hon
source_url: https://www.huntress.com/blog/cleo-software-vulnerability-malware-analysis
type: article
source: "Huntress Blog"
published: 2026-05-31T07:43:20.862Z
updated: 2026-08-24T07:00:59.320Z
tags: ["security", "java", "malware", "reverse-engineering"]
reading_time: 13
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cleo Malichus Malware Analysis CVE-2024-55956

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 13 min read · 0 upvotes · 0 comments

## Summary

Huntress researchers analyzed the Malichus malware family delivered via exploitation of CVE-2024-55956, a zero-day vulnerability in Cleo file transfer software. The malware operates in three stages: a PowerShell downloader, a Java-based second-stage downloader using AES decryption, and a modular Java post-exploitation framework. The final stage includes 9 class files supporting interactive shell access, file exfiltration via zip archiving, Cleo configuration parsing, and a fully custom C2 protocol with 13 packet types and rolling-state encryption. The framework targets both Windows and Linux but was observed only on Windows. IOCs, YARA rules, and full packet structure details are provided.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/cleo-software-vulnerability-malware-analysis>

## Similar posts on daily.dev

- [Shadowhs-fileless-linux-post-exploitation-framework](https://daily.dev/posts/shadowhs-fileless-linux-post-exploitation-framework-7ko021zbt) · Cyble · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering)

[View this post on daily.dev](https://daily.dev/posts/cleo-malichus-malware-analysis-cve-2024-55956-kpvof3hon)