- Buy or gift a Babbel subscription for 78% off to learn a new language - new low price
- Join BJ's Wholesale Club for just $20 right now to save on holiday shopping
- This $28 'magic arm' makes taking pictures so much easier (and it's only $20 for Black Friday)
- Two free ways to get a Perplexity Pro subscription for one year
- The 40+ best Black Friday PlayStation 5 deals 2024: Deals available now
MOVEit Gang Targets SysAid Customers With Zero-Day Attacks
Microsoft has revealed a new threat campaign exploiting a zero-day vulnerability in the popular SysAid IT helpdesk software.
Posting to X (formerly Twitter) yesterday, the Microsoft Threat Intelligence account said the group is the same one responsible for the MOVEit data theft and extortion campaign – a threat actor known as Lace Tempest (aka DEV-0950, FIN11 and TA505).
“Microsoft notified SysAid about the issue (CVE-2023-47246), which they immediately patched,” the post continued.
“Organizations using SysAid should apply the patch and look for any signs of exploitation prior to patching, as Lace Tempest will likely use their access to exfiltrate data and deploy Clop ransomware.”
Microsoft explained that after exploiting the vulnerability, the threat actors will issue commands via SysAid to deliver a loader for Gracewire malware to victim systems.
“This is typically followed by human-operated activity, including lateral movement, data theft, and ransomware deployment,” it added.
Read more on Lace Tempest: MOVEit Exploitation Fallout Drives Record Ransomware Attacks
A SysAid advisory revealed that the zero-day path traversal vulnerability affects its on-premises server software.
The firm urged customers to upgrade immediately to version 23.3.36, conduct a thorough assessment to check for indicators of compromise (IoCs), check relevant logs and review any credentials or other information that may have been exposed to threat actors.
“Being that this impacts on-premises deployments, this will take a long time to effectively remediate. Unlike cloud-based deployments, having this remediated will take individual action across a large number of organizations,” argued John Gallagher, VP of Viakoo Labs at Viakoo.
“While this will not be as widespread at the MOVEit vulnerability, it’s clear that the threat actor behind it is continuing to develop and deploy new ransomware threats. Organizations should use this as a warning to have effective threat assessment and remediation processes in place, especially for non-IT assets like IoT devices and applications.”