Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
Tags
country: Finland Russia
maec-delivery-vectors: Watering Hole
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Credentials - T1589.001 Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Software - T1592.002 Vulnerabilities - T1588.006 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 79d8319f-de8a-419f-9a1c-306b945e706c
Fingerprint 850a0cd3410481cb
Analysis status DONE
Considered CTI value 2
Text language
Published April 27, 2023, 1:50 p.m.
Added to db April 27, 2023, 10:46 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
Title Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
Detected Hints/Tags/Attributes 67/3/8
Source URLs
Redirection Url
Details Source https://thehackernews.com/2023/04/microsoft-confirms-papercut-servers.html
URL Provider
Details Provider Source level domain
Details thehackernews.com thehackernews.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 118 ✔ The Hacker News https://feeds.feedburner.com/TheHackersNews 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 54 
cve-2023-27351
Details CVE 85 
cve-2023-27532
Details CVE 41 
cve-2023-1389
Details File 137 
conhost.exe
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 39 
DEV-0950
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 9 
DEV-0856
Details Threat Actor Identifier - FIN 127 
FIN11
Details Threat Actor Identifier - FIN 377 
FIN7