Microsoft Blames Clop Affiliate for PaperCut Attacks

Microsoft has claimed that modern attacks exploiting two vulnerabilities in the PaperCut print administration software program are very likely the consequence of a Clop ransomware affiliate.

The two bugs in issue are CVE-2023–27350 – a critical unauthenticated remote code execution flaw – and CVE-2023–27351 – a higher severity unauthenticated info disclosure flaw. The former has a CVSS rating of 9.8.

Following currently being notified by Pattern Micro, PaperCut alerted consumers final 7 days that the vulnerabilities were being remaining exploited in the wild and urged buyers to update their servers straight away.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Microsoft Danger Intelligence yesterday attributed the latest attacks exploiting the bugs to “Lace Tempest,” a risk actor it says overlaps with FIN11 and TA505. FIN11 is linked to the infamous Clop ransomware gang and the Accellion FTA extortion campaign, when TA505 is reportedly powering the Dridex banking Trojan and Locky ransomware.

Browse additional on Clop ransomware: Raspberry Robin Worm Actors Linked to Clop, LockBit Ransomware Teams.

Also known as DEV-0950, Lace Tempest is a Clop ransomware affiliate that has formerly been detected making use of GoAnywhere exploits and Raspberry Robin malware in ransomware campaigns. Microsoft mentioned the danger group exploited the PaperCut bugs in attacks as early as April 13.

“In noticed attacks, Lace Tempest ran various PowerShell instructions to produce a TrueBot DLL, which linked to a C2 server, attempted to steal LSASS qualifications, and injected the TrueBot payload into the conhost.exe company,” Microsoft extra in a tweet.

“Next, Lace Tempest delivered a Cobalt Strike Beacon implant, done reconnaissance on related devices, and moved laterally making use of WMI. The actor then recognized and exfiltrated data files of desire applying the file-sharing app MegaSync.”

Microsoft added that other teams may perhaps also be exploiting the two PaperCut vulnerabilities in the wild, noting that some intrusions had led to deployment of the prolific LockBit ransomware.