Threat actor

Lace Tempest

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 29, 2026 · last 15d ago

Timeline2 articles

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.

PaperCut alerted customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and MF print management software, with confirmed customer incidents and an ongoing investigation. Emergency patches were released for v25 and v26, and the flaw was later identified as an exploitation chain of CVE-2026-81578 and CVE-2026-82078 enabling remote code execution. Shared IoCs include suspicious post-exploitation activity from pc-app.exe and missing, truncated or deleted server.log files with specific database errors. Users with internet-exposed PaperCut Application Servers are urged to immediately restrict access to trusted IPs; in 2023, CVE-2023-27350 (CVSS 9.8) in the same products was exploited by Lace Tempest to deliver Cl0p and LockBit ransomware.

The Hacker NewsAug 31, 06:10 UTC · 15d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078 CVE-2023-27350

PaperCut Zero-Day Under Active Attack: Emergency Patch Released

PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.

PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.

Security AffairsAug 29, 20:42 UTC · 17d agoExploit / PoC in the wildCVE-2023-27350 CVE-2023-273511

Related CVEsby mentions

CVE-2023-273509.8100%
Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG
PaperCut MF and PaperCut NG print management software contain an improper access control flaw (CWE-284) in the SetupCompleted class that allows an unauthenticated attacker to bypass authentication and reach internal administrative functionality. The flaw is triggered by sending crafted, unauthenticated requests to the PaperCut application's web interface, without requiring valid user credentials. A successful attacker gains the ability to execute code in the context of the SYSTEM account on the PaperCut server, typically a Windows print server, giving full control of that host. Any organization running PaperCut MF or NG is potentially affected, and exposure is highest where the server's web interface is reachable from the internet or by untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-04-21 with known ransomware use, and EPSS rates exploitation probability at 100% within 30 days.
· PaperCut MF · PaperCut NG KEV ransomware PoC ×3mass
CVE-2026-820789.42%
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
· PaperCut NG · PaperCut MF KEVmass
CVE-2026-815788.82%
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
· PaperCut MF · PaperCut NG KEVlarge
CVE-2023-273517.578%
Authentication Bypass in PaperCut NG/MF Print Management Software
CVE-2023-27351 is an improper authentication flaw (CWE-287) in the SecurityRequestFilter class of PaperCut NG and MF print management software, where the authentication algorithm is improperly implemented. A remote, unauthenticated attacker can trigger it over the network with no user interaction or special privileges to bypass authentication on the affected server (CVSS 3.1: 7.5). Once authentication is bypassed, the attacker gains access to the PaperCut system; in observed campaigns this access was leveraged to deliver Cl0p and LockBit ransomware, as confirmed by Microsoft. Organizations running PaperCut NG (version 22.0.5, Build 63914, is cited in the advisory) or PaperCut MF are affected. The flaw was exploited as a zero-day, is CISA KEV-listed (added 2026-04-20) with known ransomware use, and EPSS places the 30-day exploitation probability at 78.1%.
· PaperCut NG 22.0.5 (Build 63914) explicitly cited as affected; CISA lists PaperCut NG broadly without a full version range · PaperCut MF affected per CISA listing; no specific version range provided in the data KEV ransomwarelarge

Appears with

product PaperCut MF 2 product PaperCut NG 2 vendor PaperCut 2 threat actor DEV-0950 1 vendor Microsoft 1 malware Raspberry Robin 1 organization Clop 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.