CISA have added the new CVE for the Cleo zero day to KEV.
Top stuff from Bleeping Computer here in terms of investigation.
So it looks like some ransomware operators are wearing multiple group hats.
For what it’s worth, I’ve found some novel ways of tracking ransomware operators. I don’t want to reveal how as I don’t want to blow the access.
Also, good on cl0p for narrowing the extortion criteria.