SysAid Zero-Day Exploits: A Growing Threat in Ransomware Attacks

The threat actor Lace Tempest has been exploiting a zero-day vulnerability in the SysAid IT support software to distribute the Cl0p ransomware. The vulnerability, tracked as CVE-2023-47246, allows for code execution within on-premise installations and has been patched by SysAid. After exploiting the flaw, Lace Tempest deploys a malware loader for the Gracewire malware, followed by human-operated activities such as lateral movement, data theft, and ransomware deployment. The attack involves uploading a web shell and other payloads into the SysAid Tomcat web service, as well as the use of the MeshCentral Agent and PowerShell to download and run Cobalt Strike. Organizations using SysAid are advised to apply the patches promptly and scan for signs of exploitation. The FBI has also warned about ransomware attackers targeting third-party vendors and legitimate system tools to compromise businesses.