UPDATE: Researchers from Microsoft have attributed the active exploitation of two (2) critical PaperCut vulnerabilities to threat actors linked to the Clop ransomware operation. A proof-of-concept (PoC) exploit was recently published by researchers, breaking down the vulnerability and giving the technical details for exploitation. The first vulnerability, tracked as CVE-2023–27350, is a remote code execution (RCE) flaw that allows unauthenticated attackers to execute malicious code on servers running vulnerable versions of the very popular PaperCut print management solution. The other vulnerability, tracked as CVE-2023-27351, is an authentication bypass vulnerability that works in conjunction with the RCE vulnerability. The researchers attributed the exploitation to a threat actor tracked as “Lace Tempest”, a financially motivated Clop affiliate whose tactics, techniques, and procedures (TTPs) overlap with the FIN11 and TA505 threat actors. In this campaign, the Lace Tempest threat group is exploiting the PaperCut vulnerabilities to install a TrueBot (aka Silence.Downloader) malware loader on vulnerable PaperCut servers. TrueBot aims to infect the victim systems, collecting information to help triage interesting targets, and deploy additional payloads, while sending all relevant intelligence back to an attacker-owned command and control (C2) server. PaperCut produces printing management software for almost every major printer brand, used by government agencies, universities, and large corporations around the world. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to their Known Exploited Vulnerabilities (KEV) catalog, mandating that all federal civilian executive branch (FCEB) agencies patch the flaws by May 12, 2023, or face being held accountable by regulators. CTIX analysts will continue to monitor the fallout from this campaign, and further updates may be published if novel findings become public.