Critical Vulnerability in Cleo Software Actively Exploited in the Wild

The exploitation chain leverages an arbitrary file-write vulnerability. The attackers plant malicious files in Cleo’s autorun directory, which the software automatically processes and deletes post-execution.