{"id":21877,"date":"2023-05-01T05:18:15","date_gmt":"2023-05-01T13:18:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/05\/01\/news-15608\/"},"modified":"2023-05-01T05:18:15","modified_gmt":"2023-05-01T13:18:15","slug":"news-15608","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/05\/01\/news-15608\/","title":{"rendered":"LockBit and Cl0p ransomware gangs actively exploiting Papercut vulnerabilities"},"content":{"rendered":"

A few days ago we wrote about two vulnerabilities found in PaperCut application servers<\/a>. As we noted, exploitation was fairly simple so there was some urgency to install the patches. My esteemed colleague Chris Boyd literally wrote:<\/p>\n

“Arbitrary code can be deployed, or even ransomware if that’s part of the attacker’s toolkit.”<\/p><\/blockquote>\n

As it turns out, there are already two flavors of ransomware preying on those that haven’t updated yet.<\/p>\n

A Cl0p affiliate, branded as DEV-0950 by Microsoft<\/a> has already incorporated the PaperCut exploits into its attacks. This affiliate has also been known to use the GoAnywhere zero-day that basically brought Cl0p back<\/a> from the dead last month.<\/p>\n

In a surprising turn of events for the ransomware landscape, Cl0p emerged as the most used ransomware in March 2023<\/a>, coming out of nowhere to dethrone the usual frontrunner, LockBit.<\/p>\n

\"Known
Known ransomware attacks in March 2023, listed by gang<\/figcaption><\/figure>\n

But don’t rule the habitual frontrunner LockBit out just yet. Microsoft Threat Intelligence said in a tweet<\/a> that it’s “monitoring other attacks also exploiting these vulnerabilities, including intrusions leading to Lockbit deployment.”<\/p>\n

\n

PaperCut is printing management software that works by intercepting print jobs as they pass into a print queue. It’s used by large companies, state organizations, and education institutes because it is compatible with all major printer brands and platforms. This makes a vulnerability, especially one that is as easy to exploit, a virtual goldmine for ransomware peddlers, and puts a bullseye on anyone that is running an unpatched server.<\/p>\n

Both the underlying vulnerabilities have been addressed with patches. If you update your PaperCut application servers, you are no longer at risk. From the Updating FAQ<\/a>:<\/p>\n