SysAid Zero-Day Flaw Exploited in Ransomware Attacks: Microsoft and SysAid Issue Urgent Patch Warning

Threat actors are exploiting a zero-day vulnerability in the service management software SysAid to gain access to corporate servers for data theft and to deploy Clop ransomware. The vulnerability, identified as CVE-2023-47246, was discovered by Microsoft and used by a threat actor known as Lace Tempest. SysAid has released a patch for the vulnerability and provided indicators of compromise to help detect or prevent the intrusion. SysAid users are strongly recommended to update to version 23.3.36 or later and conduct thorough server checks for signs of compromise.