Lace Tempest

Lace Tempest, a threat actor known for executing actions with malicious intent, has been identified as the orchestrator behind a series of cyber attacks exploiting a zero-day vulnerability in SysAid. The exploit was first brought to light by SysAid and further detailed in a blog post on TuxCare. This attack had similarities to previous campaigns orchestrated by Lace Tempest, including those against Accellion FTA in 2020 and GoAnywhere MFT in 2023. Microsoft's threat intelligence team and SysAid’s Advisory confirmed that this zero-day flaw has indeed been exploited by Lace Tempest (DEV-0950 / TA-505). The threat actor used Google ads to lure users into downloading malicious MSIX packages, leading to the delivery of POWERTRASH malware, which subsequently loads NetSupport and Gracewire, both typically associated with Lace Tempest. POWERTRASH is then utilized to load additional malware, indicating a complex and multi-layered attack strategy. These tactics underscore the persistent and evolving nature of cyber threats posed by Lace Tempest. Notably, Lace Tempest's association with Clop ransomware raises significant concerns due to their past involvement in data theft and ransom threats. Microsoft highlighted that Lace Tempest might leverage their access to exfiltrate data and deploy Clop ransomware, drawing parallels with their tactics in the MoveIT Transfer attacks. The gravity of the Lace Tempest cyber attack emphasizes the need for robust cybersecurity measures and vigilance against such advanced threat actors.