DEV-0950Threat actor
- Lace Tempest
Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrating data from compromised networks.From MISP Galaxy
Last reported 2 years ago, by Huntress2 reports
What the reports say
2 reports, newest first · the exact sentence from each-
Critical Vulnerability: SysAid CVE-2023-47246“Days prior, Microsoft had notified SysAid of this issue and that they attributed these compromises to TA505 “Lace Tempest”, often known as the cl0p ransomware gang.”
-
MOVEit Transfer Critical Vulnerability CVE-2023-34362“Microsoft has now attributed this threat to "Lace Tempest" (per their new naming scheme) or the group behind the cl0p ransomware gang.”
Indicators in its reports
named in the reports above- 5.252.190[.]181in 1 report
- 5.252.191[.]14in 1 report
- 5.252.190[.]233in 1 report
- 5.252.190[.]116in 1 report
- 5.252.191[.]88in 1 report
- 89.39.105[.]108in 1 report
- 148.113.152[.]144in 1 report
- 138.197.152[.]201in 1 report
- 209.97.137[.]33in 1 report
- hxxps://community.progress[.]com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023in 1 report
- community.progress[.]comin 1 report
- hxxps://www.reddit[.]com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/in 1 report
- hxxps://www.trustedsec[.]com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/in 1 report
- www.trustedsec[.]comin 1 report
- hxxps://digital.nhs[.]uk/cyber-alerts/2023/cc-4326in 1 report
- digital.nhs[.]ukin 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.