The bank first revealed in a February SEC filing that the attackers exploited a zero-day vulnerability in the third-party software (disclosed by the vendor on October 27, 2024) to hack a limited number of Western Alliance systems and exfiltrate files stored on the compromised devices. An analysis of the stolen files concluded on February 21, 2025, and found they contained customer personal information, including your name and Social Security number, as well as their dates of birth, financial account numbers, driver's license numbers, tax identification numbers, and/or passport information if it was provided to Western Alliance. Arizona-based Western Alliance Bank is notifying nearly 22,000 customers their personal information was stolen in October after a third-party vendor's secure file transfer software was breached. "We have no evidence to believe that your personal information has been misused for the purpose of committing fraud or identity theft," Western Alliance added, saying it's also offering those affected one year of free membership for Experian IdentityWorks Credit 3B identity protection services. The cybercrime group was behind a series of attacks exploiting a pre-auth zero-day vulnerability (CVE-2024-50623) in Cleo LexiCom, VLTransfer, and Harmony software patched in October, when the company warned customers to upgrade immediately. In December, Cleo released security updates for a second zero-day (tracked as CVE-2024-55956) that the Clop threat actors exploited to deploy a JAVA backdoor dubbed "Malichus" to steal data, execute commands, and gain further access to the victims' networks. While the secure file transfer software compromised in the breach was not named in the breach notification letters or the February SEC filing, the bank is one of 58 companies the Clop ransomware gang added to its leak site in January. Western Alliance found that customer data was exfiltrated from its network only after discovering that the attackers leaked some files stolen from its systems. "This vulnerability has been leveraged to install malicious backdoor code on certain Cleo Harmony, VLTrader, and LexiCom instances in the form of a malicious Freemarker template containing server-side JavaScript," Cleo explained in a private advisory.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 18 Mar 2025 19:50:58 +0000