Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · DEV-0950 · Unknown · misp-galaxy · refreshed 2026-10-06

DEV-0950

  • Lace Tempest

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE3 new CVEs: CVE-2023-47246, CVE-2024-50623, CVE-2024-55956

Analyst brief

misp-galaxy

Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrating data from compromised networks.

CVEs DEV-0950 is cited as exploiting

none on KEV
  1. CVE-2024-559562026-10-17
    1. “In October, the threat actor Lace Tempest, known for exploiting 0-days in file-transfer software, was observed exploiting vulnerabilities in Cleo products (CVE-2024-50623, CVE-2024-55956).”

      cited as exploiting · source: x.com ↗ · 2026-10-17

  2. CVE-2024-506232026-10-17
    1. “In October, the threat actor Lace Tempest, known for exploiting 0-days in file-transfer software, was observed exploiting vulnerabilities in Cleo products (CVE-2024-50623, CVE-2024-55956).”

      cited as exploiting · source: x.com ↗ · 2026-10-17

  3. CVE-2023-472462026-10-17
    1. “Microsoft notified SysAid of the activity, who investigated and determined that there was a zero-day vulnerability in the SysAid on-premises software. SysAid quickly released an update addressing CVE-2023-47246, a path traversal vulnerability.”

      cited as exploiting · named nearby · source: techcommunity.microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

3 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2023-47246 exploitation attempt

    CVE-2023-47246 · DEV-0950

    T1190conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

1 source
  1. 1.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-pa…

Track DEV-0950 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.