Hacker Group Exploits Zero-Day Bug to Target ITSM Platform

A critical zero-day vulnerability (CVE-2023-47246) in the SysAid IT support and management software solution is being exploited by the ransomware affiliate Lace Tempest, known for deploying Cl0p ransomware. This is not the first time Lace Tempest has exploited zero-day vulnerabilities, having previously targeted Progress Software's MOVEit Transfer installations, Accellion file transfer appliance, and Fortra's GoAnywhere file transfer solution. The vulnerability allows unauthorized access to affected systems and execution of arbitrary code. SysAid has released a patch (v23.3.36) and advised customers to update their systems and check for evidence of compromise.