Aon Ransomware Attack Analysis: Termite Group Exploits CVE-2024-50623 in Cleo Software

{
  "signal_id": "19e41051-1eab-16dc-e373-89ac8d53b024",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-10-07T08:18:23+00:00",
  "company": {
    "name": "Aon",
    "domain": "aon.com"
  },
  "data": {
    "url": "https://www.rescana.com/post/aon-ransomware-attack-analysis-termite-group-exploits-cve-2024-50623-in-cleo-software",
    "title": "Aon Ransomware Attack Analysis: Termite Group Exploits CVE-2024-50623 in Cleo Software - Rescana",
    "excerpt": "On October 7, 2026, Aon , a leading professional services firm, was publicly reported as the victim of a ransomware attack attributed to the Termite group. The breach was discovered on October 7, 2026, with the initial compromise occurring on October 6, 2026. The incident highlights the persistent threat posed by ransomware actors targeting organizations in the risk management, insurance, and human capital sectors. At the time of writing, no official statement from Aon or law enforcement has been released, and the specific data compromised has not been detailed in public sources. This advisory synthesizes available threat intelligence and technical analysis to inform customers of the attack’s context, technical details, and recommended mitigations. The attack on Aon is attributed to the Termite ransomware group, which has a documented history of targeting high-value organizations across supply chain, healthcare, and professional services sectors. The group is known for leveraging vulnerabilities in third-party software to gain initial access, followed by rapid lateral movement and data encryption. Technical analysis from multiple sources indicates that Termite exploited a vulnerability in Cleo file transfer products, specifically LexiCom , VLTransfer , and Harmony . The vulnerability, tracked as CVE-2024-50623 , is an unauthenticated remote code execution (RCE) flaw. Notably...",
    "summary": "Aon was the victim of a ransomware attack attributed to the Termite group exploiting an unauthenticated remote code execution flaw in Cleo file transfer software.",
    "planning": false,
    "image_url": "https://www.rescana.com/post/img/aon-ransomware-attack-analysis-termite-group-exploits-cve-2024-50623-in-cleo-software-cover.png",
    "confidence": 0.95,
    "published_at": "2026-10-07T08:18:23Z",
    "vulnerability": "Termite ransomware group exploited an unauthenticated remote code execution flaw (CVE-2024-50623) in Cleo file transfer products (LexiCom, VLTransfer, Harmony) for initial access, followed by lateral movement, enumeration of mapped drives, deletion of shadow copies, and resource encryption",
    "effective_date": "2026-10-06",
    "article_sentence": "On October 7, 2026, Aon , a leading professional services firm, was publicly reported as the victim of a ransomware attack attributed to the Termite group."
  }
}

curl https://signals.autobound.ai/v1/signals/19e41051-1eab-16dc-e373-89ac8d53b024 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"aon.com","limit":20}'