Cl0p threat actors, otherwise known as TA505 or Lace Tempest, have been observed actively exploiting a zero-day vulnerability in SysAid, a comprehensive IT Service Management (ITSM) solution, to infiltrate corporate servers for data theft and to deploy ransomware. The vulnerability, tracked as CVE-2023-47246, is a path traversal flaw that leads to remote code execution (RCE). The compromise was discovered on November 2, 2023, when attackers breached on-premise SysAid servers. Once successfully exploited, attackers upload a Web Application Resource (WAR) archive containing a webshell to the SysAid Tomcat web service, enabling the malicious activity. This includes executing PowerShell scripts, injecting GraceWire malware into legitimate processes, and avoiding detection by security products like Sophos. SysAid released a report detailing the attack mechanism and the steps taken by the threat actor, including data exfiltration and log deletion to cover their tracks. They also deployed additional scripts for Cobalt Strike listener access on compromised hosts. SysAid has since patched the flaw, and CTIX analysts urge all administrators and maintainers responsible for on premise SysAid servers to update to the latest version immediately. Administrators are also advised to inspect servers for any signs of compromise. SysAid’s report provides indicators of compromise (IOCs), including filenames, hashes, IP addresses, file paths, and attacker commands to help detect or prevent intrusions.