View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
April 27, 2023updated 21 Aug 2023 3:45pm

PaperCut vulnerabilities exploited using LockBit and Cl0p ransomware – Microsoft

The flaws in the popular print management software could help criminals gather data for secondary attacks.

By Claudia Glover

Critical exploits in print management software PaperCut are being exploited by criminals linked to notorious Russian ransomware gangs LockBit and Cl0p, Microsoft security researchers have said. Patches for the vulnerabilities have been released and PaperCut is urgently advising customers to install them as soon as they can.

Vulnerabilities in PaperCut’s print management software exploited in the wild by ransomware gangs. (Photo by A_stockphoto/Shutterstock)

The attacks began on 16 April, when cybercriminals were detected using the flaws to install remote management software. PaperCut’s products are used by large enterprises, healthcare and education institutions and local government agencies. The company has more than 100 million users and over 70,000 organisations worldwide, according to its website.

PaperCut bugs exploited by LockBit and Cl0p

Two critical vulnerabilities in PaperCut’s systems classified as CVE-2023-27350 and CVE-2023-27351 are being used by ransomware gangs to move laterally through user systems and gather information which they can use to launch secondary social engineering and phishing attacks

Patches to these flaws were released by PaperCut at the end of March. However, last week on 19 April the company released an advisory warning that these flaws were being heavily exploited in the wild. 

Security company Huntress then produced evidence showing that hackers are exploiting the vulnerabilities to install remote control software Atera and Syncro to unpatched servers. The company has detected 1,800 internet-facing servers that have been targeted. 

The same report revealed that 90% of Windows hosts of PaperCut software are vulnerable to these attacks.

Late on Wednesday Microsoft announced the criminals it believes are exploiting these vulnerabilities in the wild. Attacks have been carried out by the Lace Tempest criminal gang, delivering Cl0p ransomware, according to tweets from Microsoft’s Threat Intelligence team. 

Content from our partners
Unlocking growth through hybrid cloud: 5 key takeaways
How businesses can safeguard themselves on the cyber frontline
How hackers’ tactics are evolving in an increasingly complex landscape

Lace Tempest is a Cl0p ransomware affiliate that has been observed using various exploits and open-source tools to conduct reconnaissance and steal credentials.

The gang has also been observed deploying LockBit ransomware. “More threat actors could follow suit,” Microsoft warns. “It’s critical for organisations to follow PaperCut’s recommendation to upgrade applications and servers.” 

How do the vulnerabilities work?

The first bug, CVE-2023-27350, has a CVSS score of 9.8, making it a critical flaw. It is described by PaperCut as an exploit that “allows for an unauthenticated attacker to get remote code execution (RCE) on a PaperCut Application Server. This could be done remotely and without the need to log in”.

If an attacker already has a basic foothold in a network, as a guest user on an employee laptop for example, a cybercriminal can use this bug to pivot to a more powerful position in the business, explains a report by security company Sophos. 

PaperCut describes the second bug, CVE-2023-27351 with a rating of 8.2, as a flaw that “allows for an unauthenticated attacker to potentially pull information about a user stored within PaperCut MF or NG – including usernames, full names, email addresses, office/department info and any card numbers associated with the user”.

The second bug allows attackers to scrape data from the system they have infiltrated. Details of how to update PaperCut software can be found here.

Read more: Microsoft is now a cybersecurity titan. That could be a problem

Topics in this article :
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.