Lace Tempest

Lace Tempest is a financially motivated threat actor tracked by Microsoft as DEV-0950 and associated with the Cl0p/Clop ransomware operation. Microsoft states its activity overlaps with FIN11 and TA505. The group has been linked to data theft, extortion, and ransomware activity, including operation of the Clop extortion site. Based on the provided content, Lace Tempest has exploited multiple high-profile enterprise software vulnerabilities for initial access and follow-on intrusion activity. In April 2023, exploitation of PaperCut NG/MF CVE-2023-27351 was attributed to Lace Tempest, and the group used the vulnerability in campaigns delivering Cl0p and LockBit ransomware. Microsoft assessed the actor began exploiting PaperCut vulnerabilities around April 13, 2023 for initial access, then deployed TrueBot, followed by Cobalt Strike for lateral movement, and used MegaSync for data theft. Some PaperCut intrusions led to LockBit ransomware deployment. Microsoft also attributed the MOVEit Transfer zero-day attacks involving CVE-2023-34362 to Lace Tempest. The content describes the actor as previously linked to Cl0p ransomware, data theft, and extortion attacks, and notes overlap with TA505 and FIN11. The broader campaign involved theft of data from compromised MOVEit environments and extortion pressure via the Clop leak/extortion ecosystem. In late 2023, Lace Tempest/DEV-0950 exploited the SysAid on-premise zero-day CVE-2023-47246. The group uploaded a web shell and additional payloads into the webroot of the SysAid Tomcat web service, gaining unauthorized access and control of affected systems. Microsoft further observed Lace Tempest issuing commands via SysAid software to deliver a malware loader. The content also notes that Gracewire malware is typically affiliated with Lace Tempest, and that Sangria Tempest has cooperated with Lace Tempest in past intrusions. Known aliases and related tracking names mentioned in the content include DEV-0950, FIN11, and TA505.