---
title: "Threat Intel Content Update: 12/17/24"
description: Tidal Cyber's threat intelligence content updates for the week of 12/17/24 Termite Ransomware Zero-Day Attacks
---

[Threat Intelligence Content Updates ](https://www.tidalcyber.com/threat-updates)

# [Threat Intel Content Update: 12/17/24](https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-12/17/24)

 Written by [Tidal Cyber](https://www.tidalcyber.com/threat-updates/author/tidal-cyber) | Dec 18, 2024 4:27:27 PM

#### Termite Ransomware Zero-Day Attacks

****Threat Content Highlights****

- New “Trending & Emerging Threats” Tidal-curated Threat Profile update for the week: **Termite Ransomware Zero-Day Attacks**  
    
    - Actors were observed exploiting vulnerabilities (CVE-2024-55956 & CVE-2024-50623) in Cleo managed file transfer ("MFT") products. These products are used by more than 4,000 customers, especially in retail but also a variety of other industries, underscoring the size & breadth of the potential attack surface.
    - Researchers drew comparisons to a campaign in mid-2023, where Clop ransomware operators used a zero-day exploit to compromise a different MFT solution (MOVEit), **exposing potentially millions of records associated with numerous prominent brands**. This Threat Profile features a [new Campaign object](https://app.tidalcyber.com/campaigns/2c957f94-8b61-49b9-b914-74a06f8b91cd) with the Technique relationships related to observed Cleo software exploit attacks and associated tools. [News reports](https://www.darkreading.com/cyberattacks-data-breaches/termite-ransomware-behind-cleo-zero-day-attacks) linked attacks to Termite actors, and our [Termite Ransomware object](https://app.tidalcyber.com/software/51a9d952-4cc3-4c4c-8f43-f4c25f44d830?tab=2) is also included here for context (but note: reporting to-date has not indicated the ransomware binary specifically was observed during the recent attacks).

[View full post](https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-12/17/24)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Tidal Cyber"
  },
  "dateModified" : "2024-12-18T16:27:27.499Z",
  "datePublished" : "2024-12-18T16:27:27Z",
  "headline" : "Threat Intel Content Update: 12/17/24",
  "image" : {
    "@type" : "ImageObject",
    "height" : 500,
    "url" : "https://21164103.fs1.hubspotusercontent-na1.net/hubfs/21164103/Threat%20Intelligence%20Content%20Update%20Social.jpg",
    "width" : 900
  },
  "mainEntityOfPage" : "https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-12/17/24",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Threat Intelligence Content Updates"
  }
}
```