PaperCut vulnerabilities leveraged by Clop, LockBit ransomware affiliates
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG PaperCut MF and PaperCut NG print management software contain an improper access control flaw (CWE-284) in the SetupCompleted class that allows an unauthenticated attacker to bypass authentication and reach internal administrative functionality. The flaw is triggered by sending crafted, unauthenticated requests to the PaperCut application's web interface, without requiring valid user credentials. A successful attacker gains the ability to execute code in the context of the SYSTEM account on the PaperCut server, typically a Windows print server, giving full control of that host. Any organization running PaperCut MF or NG is potentially affected, and exposure is highest where the server's web interface is reachable from the internet or by untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-04-21 with known ransomware use, and EPSS rates exploitation probability at 100% within 30 days. Do: Apply the vendor's updates as instructed (this is the required action in CISA KEV) — upgrade PaperCut MF/NG to the patched releases listed in PaperCut's security advisory rather than relying on unpatched installs. Until patched, restrict network access to the PaperCut web/admin interface so it is reachable only from trusted hosts, and check the server for signs of compromise given known ransomware use. Prioritize internet-facing PaperCut servers, which public scans show are exposed in the thousands. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masstens of thousands of organizations (~70k+) and millions of users; thousands of internet-exposed PaperCut servers | |
| CVE-2023-27351 | Authentication Bypass in PaperCut NG/MF Print Management Software CVE-2023-27351 is an improper authentication flaw (CWE-287) in the SecurityRequestFilter class of PaperCut NG and MF print management software, where the authentication algorithm is improperly implemented. A remote, unauthenticated attacker can trigger it over the network with no user interaction or special privileges to bypass authentication on the affected server (CVSS 3.1: 7.5). Once authentication is bypassed, the attacker gains access to the PaperCut system; in observed campaigns this access was leveraged to deliver Cl0p and LockBit ransomware, as confirmed by Microsoft. Organizations running PaperCut NG (version 22.0.5, Build 63914, is cited in the advisory) or PaperCut MF are affected. The flaw was exploited as a zero-day, is CISA KEV-listed (added 2026-04-20) with known ransomware use, and EPSS places the 30-day exploitation probability at 78.1%. Do: Upgrade PaperCut NG/MF to the fixed release per the vendor's emergency patch advisory, first confirming the running build (NG 22.0.5, Build 63914, is cited as affected). Restrict internet-facing access to PaperCut servers and hunt for signs of post-exploitation, given confirmed use to deliver Cl0p and LockBit ransomware. US federal agencies must apply mitigations per CISA BOD 22-01 (or vendor instructions) or discontinue use of the product if mitigations are unavailable. | 7.5 | 78% | KEV ransomware |
| large≈75,000+ sites/organizations (PaperCut NG/MF is deployed at tens of thousands of organizations; public scans have found thousands of servers directly… |
Full article330 words · extracted from helpnetsecurity.com · click to collapse
Clop and LockBit ransomware affiliates are behind the recent attacks exploiting vulnerabilities in PaperCut application servers, according to Microsoft and Trend Micro researchers.
The detected campaings
“Microsoft is attributing the recently reported attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to deliver Clop ransomware to the threat actor tracked as Lace Tempest (overlaps with FIN11 and TA505),” Microsoft shared.
“Lace Tempest (DEV-0950) is a Clop ransomware affiliate that has been observed using GoAnywhere exploits and Raspberry Robin infection hand-offs in past ransomware campaigns. The threat actor incorporated the PaperCut exploits into their attacks as early as April 13.”
The attackers are attempting to steal LSASS credentials, deliver Truebot downloader malware and a Cobalt Strike Beacon implant. They move laterally within targets’ network by using Windows Management Instrumentation (WMI), and exfiltrate files via the MegaSync file-sharing app.
“We’re monitoring other attacks also exploiting these vulnerabilities, including intrusions leading to Lockbit deployment. More threat actors could follow suit,” they warned.
Trend Micro researchers documented a Lockbit campaign that starts with the exploitation of CVE-2023-27350.
The attackers run a PowerShell script via the exploited app and download the LockBit ransomware from a temporary hosting site.
Urgent action is needed
Clop and LockBit ransomware-as-a-service (RaaS) affiliates are among the five most active ransomware threat actors.
Microsoft says that the Clop affiliate is exploiting CVE-2023-27350 (a RCE flaw) and CVE-2023-27351 (an information disclosure flaw). Trend Micro says the LockBit affiliate is exploiting just the former.
In any case, admins are advised to upgrade to one of the versions with fixes for both: PaperCut MF and NG versions 20.1.7, 21.2.11 or 22.0.9 – especially because a PoC for CVE-2023-27350 has been publicly released, so more threat actors could start using it.
PaperCut has published advice on what to do if you suspect one of your servers has been compromised, and Trend Micro’s Zero Day Initiative has released rules and filters that can help protect against exploitation of this vulnerability.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/04/27/papercut-lockbit-clop/