Critical PaperCut Vulnerability Exploited in State-Sponsored Attacks, Microsoft Warns

Microsoft has reported that Iranian nation-state groups are actively exploiting a critical vulnerability discovered in PaperCut print management software. The threat intelligence team at Microsoft observed the involvement of Mango Sandstorm (Mercury) and Mint Sandstorm (Phosphorus) in leveraging the CVE-2023-27350 flaw to gain initial access in their operations.

Microsoft noted that Mint Sandstorm demonstrated the ability to quickly incorporate proof-of-concept exploits into their operations, while Mango Sandstorm relied on tools from previous intrusions to connect to their command and control infrastructure.

Microsoft has identified connections between Lace Tempest, FIN11, TA505 cybercrime gangs, and the Clop ransomware operation in recent attacks. Additionally, Microsoft found that some of these intrusions resulted in LockBit ransomware attacks, although further details were not provided. The Cybersecurity and Infrastructure Security Agency (CISA) included the PaperCut vulnerability (CVE-2023-27350) in its list of actively exploited vulnerabilities. Federal agencies were ordered to secure their PaperCut servers within three weeks.

This vulnerability is a critical remote code execution bug in PaperCut MF or NG versions 8.0 or later and does not require authentication. PaperCut’s enterprise printing management software is widely used by large companies, state organizations, and educational institutions worldwide. The software claims to have over 100 million users across more than 70,000 companies, making it a significant target for attackers.

Researchers quickly released PoC exploits for the RCE bug disclosed in March 2023, and Microsoft later warned that Clop and LockBit ransomware groups were using it to gain initial access to corporate networks. Despite indicators of compromise and detection rules from multiple cybersecurity companies, VulnCheck revealed a new attack method that bypasses existing detections, allowing uninterrupted exploitation of CVE-2023-27350.

It is crucial for defenders to develop robust and comprehensive detections that cannot be easily evaded, as attackers learn from publicly available detection methods. To eliminate the RCE bug and mitigate the associated attack vector, defenders are strongly recommended to promptly upgrade their PaperCut MF and PaperCut NG software to versions 20.1.7, 21.2.11, and 22.0.9 or newer.