Microsoft has confirmed that the active exploitation of PaperCut servers is linked to attacks designed to deliver Cl0p and LockBit ransomware families. The tech giant’s threat intelligence team has attributed a subset of the intrusions to a financially motivated actor it tracks under the name Lace Tempest, highlighting the evolving threat landscape that businesses and organizations face as bad actors continue to adapt and innovate.
Active exploitation of PaperCut servers linked to Cl0p and LockBit ransomware families
Over the last few months, a series of cyber-attacks involving ransomware has hit numerous organizations around the world. These attacks leverage a range of techniques, including exploiting vulnerabilities in commonly used software and social engineering tactics.
Microsoft has confirmed that the active exploitation of PaperCut servers has been linked to a range of attacks designed to deliver Cl0p and LockBit ransomware families. In April 2023, the threat actors incorporated PaperCut flaws (2023-27350 and CVE-2023-27351) into their attack toolkit, which allowed them to gain access to vulnerable systems and deploy the ransomware.
According to Microsoft, a separate cluster of activity has also been detected weaponizing the same flaws, including the ones that lead to LockBit ransomware infections. This highlights the ongoing threat posed by ransomware and emphasizes the importance of keeping software up-to-date and patched.
Raspberry Robin/QNAP Worm believed to be Access-as-a-Service malware
Another example of the evolving threat landscape is Raspberry Robin, also called QNAP worm. Microsoft has stated that it is believed to be an “access-as-a-service” malware that is used as a delivery vehicle for next-stage payloads, such as IcedID, Cl0p, and LockBit. The malware infects vulnerable devices, such as enterprise storage systems, which can then be used to launch further attacks against a target organization.
Attribution of a subset of intrusions to financially motivated actor “Lace Tempest”
Microsoft’s threat intelligence team has attributed a subset of the intrusions involving PaperCut servers and ransomware to a financially motivated actor it tracks under the name Lace Tempest. The group is known for its use of various tactics, including prolific phishing campaigns that target both individuals and businesses.
The group has used a range of tactics to evade detection, including using legitimate cloud services to host their malware. Microsoft’s attribution of the attacks to Lace Tempest highlights the importance of strong cybersecurity measures and the need to remain vigilant against such threats.
FIN7 Cybercrime Group is linked to attacks that exploit unpatched Veeam backup software instances
The FIN7 cybercrime group has been linked to attacks that exploit unpatched Veeam backup software instances. WithSecure detected the activity on March 28, 2023, and it likely involved the abuse of CVE-2023-27532. The group is notorious for its attacks on financial institutions and retailers, and frequently uses tactics such as spear-phishing and social engineering.
Utilization of Custom PowerShell Scripts in FIN7 Attacks
The FIN7 group also utilized custom PowerShell scripts to retrieve stored credentials from the backup servers, gather system information, and establish an active foothold in the compromised host by executing DICELOADER. This highlights the need for comprehensive security measures, including strong passwords, multi-factor authentication, and monitoring for anomalous activity.
Mirai botnet authors have updated the malware to exploit a high-severity flaw in TP-Link Archer AX21 routers
In another example of the evolving threat landscape, the authors of the Mirai botnet have updated their malware to include CVE-2023-1389, a high-severity flaw in TP-Link Archer AX21 routers that could allow an unauthenticated adversary to execute arbitrary code on affected installations. The first signs of in-the-wild exploitation emerged on April 11, 2023, highlighting the need for prompt patching and vulnerability management.
The threat landscape facing businesses and organizations today is constantly evolving, and bad actors are continually innovating and adapting their tactics to evade detection and cause harm. The recent attacks involving ransomware and access-as-a-service malware, as well as the Mirai botnet’s exploitation of a high-severity flaw in routers, serve as stark reminders of the importance of strong cybersecurity measures, comprehensive vulnerability management, and ongoing vigilance against emerging threats. It is essential that organizations remain up-to-date with the latest security patches and advisories, as well as maintain strong defenses against phishing and other social engineering tactics.
