Threat Actor Unknown origin

DEV-0950

Also known as: Lace Tempest

Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrating data from compromised networks.

Indicators of Compromise 4

IP 104[.]243[.]35[.]63 IP 216[.]152[.]148[.]54 IP 216[.]152[.]151[.]204 IP 5[.]180[.]41[.]35

MITRE ATT&CK TTPs 3

T1059.007
JavaScript
Execution
 T1105
Ingress Tool Transfer
Command And Control
 T1210
Exploitation of Remote Services
Lateral Movement

Source Articles

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Cl0p-affiliated threat actors are exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems to achieve unauthenticated remote code execution. The attackers deploy hex-named JSP web shells to gain persistent access, conduct data exfiltration, and carry out double extortion. This campaign targets high-value sectors such as manufacturing, automotive, aerospace, and retail, leveraging known vulnerabilities to compromise enterprise applications.
hacker-news ·3d ago