DEV-0950 (Lace Tempest) exploits SysAid and PaperCut vulnerabilities to deploy Clop ransomware.
DEV-0950 (Lace Tempest) is a threat actor that exploits vulnerabilities in software like SysAid and PaperCut to gain unauthorized access. The group primarily targets internal networks of organizations for network intrusion. They use TTPs such as deploying Clop ransomware and exfiltrating data from compromised environments. Defenders should focus on timely patching for SysAid, PaperCut, and similar systems, and monitor for signs of suspicious data exfiltration.
Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrating data from compromised networks.
This group exploits vulnerabilities in software like SysAid and PaperCut.
After compromising the network, they deploy Clop ransomware.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.