The prolific ransomware gang says it hacked at least 66 companies by exploiting a bug in tools made by Cleo Software.