SysAid has urged its customers to deploy the latest patch and pay close attention to the traffic in and out of their servers, as hackers were spotted abusing a zero-day flaw to drop ransomware.
In a blog post, CTO of SysAid and Profero Incident Response Team Sasha Shapirov noted the company had discovered a “potential vulnerability” on November 2, after being tipped off by Microsoft.
Further investigation determined that the vulnerability was a zero-day flaw in the SysAid on-premises software. The flaw is tracked as CVE-2023-47246 and is described as a path traversal vulnerability that allows for remote code execution.
Staying safe
Microsoft’s Threat Intelligence Team identified Lace Tempest (AKA DEV-0959) as the group abusing the flaw, apparently to drop the Cl0p ransomware encryptor. This is a multi-stage attack that starts with the upload of a WAR archive holding a WebShell and other payloads, into the webroot of the SysAid Tomcat web service. It ends with ransomware and a Cobalt Strike beacon, for good measure.
To keep their endpoints secure, SysAid urges all users to update their on-premise software to version 23.3.36, which remediates the path traversal flaw and prevents the ransomware from being installed. Furthermore, users should “conduct a comprehensive compromise assessment” of their network to look for further indicators of compromise.
More details about the indicators and how to spot Lace Tempest can be found on this link.
SysAid is an extensive IT service management (ITSM) product suite that helps businesses manage different IT services in their organization. Cl0p, on the other hand, is an infamous ransomware threat actor likely from Russia. It gained world fame last summer after it successfully infiltrated the MOVEit managed file transfer service and compromised sensitive data belonging to thousands of companies and millions of individuals.
More from TechRadar Pro
Denial of responsibility! TechCodex is an automatic aggregator of the all world’s media. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, and all materials to their authors. For any complaint, please reach us at – [email protected]. We will take necessary action within 24 hours.
Alex Smith is a writer and editor with over 10 years of experience. He has written extensively on a variety of topics, including technology, business, and personal finance. His work has been published in a number of magazines and newspapers, and he is also the author of two books. Alex is passionate about helping people learn and grow, and he believes that writing is a powerful tool for communication and understanding.
