Lace Tempest
Lace Tempest is a financially motivated threat actor tracked by Microsoft as DEV-0950 and associated with the Cl0p ransomware ecosystem. Microsoft states its activity overlaps with FIN11 and TA505, and the group is described as a Cl0p ransomware affiliate. The actor has been linked to data theft and extortion activity, including operation of or association with the Clop extortion site, and is also identified as a notable ransomware affiliate. Based on the provided content, Lace Tempest has repeatedly exploited high-profile enterprise software vulnerabilities for initial access and persistence. In April 2023, Microsoft linked the group to exploitation of PaperCut MF/NG vulnerabilities, including CVE-2023-27351, beginning around April 13, 2023. In those intrusions, Lace Tempest used the vulnerabilities for initial access, deployed TrueBot, then used Cobalt Strike for lateral movement and MegaSync for data theft; some PaperCut intrusions also resulted in Cl0p and LockBit ransomware deployment. The group was also attributed with the MOVEit Transfer zero-day campaign involving CVE-2023-34362, where Microsoft linked the attacks to Lace Tempest and the broader Cl0p data-theft and extortion operation. Related reporting in the content notes deployment of the human2.aspx webshell during MOVEit exploitation for persistence and exfiltration. The actor was also linked to exploitation of SysAid on-premise software zero-day CVE-2023-47246. In that activity, DEV-0950/Lace Tempest uploaded a webshell and additional payloads into the SysAid Tomcat webroot, gaining unauthorized access and control. Microsoft further observed Lace Tempest attacking SysAid servers from October 27, 2023, issuing commands via the SysAid software to deliver a malware loader. The content also states that Lace Tempest exploited PaperCut vulnerabilities to deploy webshells for persistent access. Additional context in the content ties Lace Tempest to ransomware and extortion operations affecting hospitals, and notes that Gracewire is typically affiliated with Lace Tempest; Microsoft also states Sangria Tempest has cooperated with Lace Tempest in past intrusions. Known aliases directly supported by the content are DEV-0950 and Lace Tempest.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Associated vulnerabilities
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
June 2 The actively exploited vulnerability was assigned CVE-2023-34362 with a severity rating of 9.8 out of 10.
CVE-2023-27351 — PaperCut NG/MF | Improper Authentication | CVSS 8.2 An improper authentication flaw in PaperCut NG/MF that allows attackers to bypass authentication via the SecurityRequestFilter class. This is not a new discovery — exploitation has been confirmed in the wild since early 2023. The vulnerability was attributed to Lace Tempest, a Cl0p ransomware affiliate, in April 2023, used in campaigns delivering Cl0p and LockBit ransomware payloads.
Two vulnerabilities were fixed in the PaperCut Application Server that allows remote attackers to perform unauthenticated remote code execution and information disclosure: CVE-2023–27350 ... Unauthenticated remote code execution flaw impacting all PaperCut MF or NG versions 8.0 or later... PaperCut disclosed that these flaws were actively exploited in the wild... A PoC exploit for the RCE flaw was released... Microsoft ... attributed the recent PaperCut attacks to the Clop and LockBit ransomware operations.
A zero-day vulnerability was discovered in SysAid's on-premise software, exploited by the group DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads, gaining unauthorized access and control. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and urges customers to conduct a comprehensive compromise assessment.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to exploitation of CVE-2023-27351 to deploy Cl0p and LockBit ransomware.
Attributed with exploiting CVE-2023-27351 in PaperCut NG/MF in campaigns delivering Cl0p and LockBit ransomware payloads.
Referenced as a ransomware group that deployed webshells for persistent access via PaperCut MF/NG vulnerabilities.
Named ransomware gang reported (by Microsoft data context) as known for targeting hospitals/healthcare organizations.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.