Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label PaperCut. Show all posts
Zero-Day Flaw
Emergency Patch PaperCut Vulnerabilities and Exploits Zero-Day Flaw

PaperCut Zero-Days Exploited, Emergency Patch Released

 

PaperCut Software has released a second emergency patch after confirming that attackers exploited two zero-day vulnerabilities in its NG and MF print management products. The flaws can be abused by unauthenticated attackers to bypass authentication and achieve remote code execution on affected PaperCut instances. 

The two issues are tracked as CVE-2026-81578 and CVE-2026-82078. CVE-2026-81578 is a high-severity authentication bypass that lets a remote attacker modify certain system configurations, while CVE-2026-82078 is a critical weakness tied to unsafe dynamic class loading in the database connection utilities. 

PaperCut said that if an attacker can manipulate system configuration parameters, arbitrary Java bytecode on the application classpath may execute under the security context of the PaperCut server process. The company first issued a security bulletin on August 27, then released an emergency patch on August 28 for versions 25 and 26, followed by a second patch later the same day to add more hardening, including support for version 24. 

Security firms monitoring the exploitation, including Huntress and WatchTowr, helped clarify that the incident involved two zero-days rather than one. WatchTowr said it found multiple patch bypasses and an additional authentication bypass flaw, which appears to have driven the need for the second emergency release. Huntress reported attacks against at least two customers, with the first exploitation attempts seen on August 26. The observed activity has so far focused on system discovery, and investigators have not seen secondary malware, command-and-control traffic, or signs of persistence from the recovered payload. 

PaperCut continues to update its advisory and is still working on a full official release that patches both vulnerabilities. The vendor also published indicators of compromise, giving defenders additional artifacts to search for across exposed systems. The wider risk is significant because PaperCut has been targeted before, and CISA’s Known Exploited Vulnerabilities catalog already includes three other PaperCut flaws, two of which were used in ransomware attacks. ShadowServer data suggests roughly 1,000 PaperCut instances are exposed on the internet, with most located in North America and Europe, making timely patching and exposure review essential for organizations running these print management platforms.
Read more »
unauthorised access
CISA & FBI Data Breach education sector Law Enforcement PaperCut Ransomware Attacks. Sensitive Data Leak unauthorised access

Bl00dy Ransomware Targets Education Orgs via PaperCut Flaw

The Federal Bureau of Investigation (FBI) has issued a warning about the Bl00dy ransomware gang targeting educational organizations through vulnerabilities in the popular print management software, PaperCut. The cybercriminals are exploiting a critical flaw in PaperCut to gain unauthorized access and launch ransomware attacks, posing a significant threat to the education sector.

The Bl00dy ransomware gang has been actively targeting schools and other educational institutions, taking advantage of the vulnerabilities in PaperCut's software. By exploiting this flaw, the attackers can gain unauthorized access to the system and deploy ransomware, encrypting critical files and demanding a ransom for their release.

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have urged educational organizations to take immediate action to address this vulnerability and strengthen their security measures. It is crucial for educational institutions to promptly update and patch their PaperCut installations to protect against potential attacks.

The Bl00dy ransomware gang's targeting of the education sector is particularly concerning as schools and colleges hold sensitive data, including student records and financial information. The impact of a successful ransomware attack can be severe, leading to significant disruptions in educational services and potential data breaches.

To defend against such attacks, educational organizations must adopt a multi-layered approach to cybersecurity. This includes regularly updating and patching software and systems, implementing robust network security measures, and conducting regular backups of critical data. Additionally, user awareness training can help educate staff and students about potential threats and how to avoid falling victim to social engineering tactics.

The FBI and CISA have emphasized the importance of reporting any suspected or confirmed cyberattacks to law enforcement agencies promptly. Timely reporting can assist authorities in tracking and apprehending cybercriminals, while also providing valuable intelligence to help prevent future attacks.

The PaperCut vulnerability was used by the Bl00dy ransomware gang to extort money, underscoring the constantly changing nature of cyber threats and the necessity for ongoing monitoring. Prioritizing cybersecurity measures is essential as businesses continue to rely on digital systems and services to protect sensitive information and ensure smooth operations.

In order to effectively address risks and adopt cybersecurity measures, educational institutions must be proactive. The education sector may reduce the chance of falling victim to ransomware attacks and safeguard the integrity of their systems and data by being watchful, updating software, and working with law enforcement organizations.



Read more »
Vulnerabilities and Exploits
CVE-2023-27350 LockBit ransomware gangs log file detection PaperCut Sysmon-based detections VulnCheck Vulnerabilities and Exploits

New Way to Exploit PaperCut Vulnerability Detected


Cybersecurity professionals have recently discovered a new way to exploit a new critical vulnerability in PaperCut servers in a way that gets past all current detections. 

The flaw, tracked as CVE-2023-27350 (CVSS score 9.8), which affects PaperCut MF or NG versions 8.0 or later, is a critical severity unauthenticated remote code execution bug that has been used in ransomware campaigns.

The flaw, discovered in March 2023 apparently enabled threat actors to execute code through PaperCut’s built-in scripting interface. While the flaw was later patched, an update on the advisory was released in April, warning it has been actively exploited in attacks.

Since then, a variety of threat actors, including ransomware operators, have exploited the vulnerability, and post-exploitation activities have resulted in the execution of PowerShell instructions used to deliver extra payloads.

Researchers soon released PoC exploits for the RCE flaw, and Microsoft later confirmed that the Clop and LockBit ransomware gangs had used it to gain initial access. In response, several security firms have provided detection guidelines for PaperCut attacks and indicators of compromise, including Sysmon, log files, and network signatures.

However, a new attack technique, identified by VulnCheck researchers, can bypass current detections, enabling attackers to exploit CVE-2023-27350 without hindrance. "This report shows that detections that focus on one code execution method, or that focus on a small subset of techniques used by one threat actor, are doomed to be useless in the next round of attacks," explains VulnCheck.

Bypassing Detection 

According to VulnCheck, Sysmon-based detections that rely on process creation analysis have already been defeated by existing PoCs that employ different child process creation methods.

In regards to the log file detection, it notes that they cannot be trusted as an accurate indicator for vulnerability exploits, since they only flag normal admin user logging. Moreover, there is a way to exploit CVE-2023-27350 without leaving entries in the log files.

In place of a built-in scripting interface, the recently released PoC exploits the "User/Group Sync" feature in PaperCut NG, enabling an admin user to define a custom program for user authentication.

VulnCheck's PoC uses "/usr/sbin/python3" for Linux and "C:\Windows\System32\ftp.exe" for Windows and provides the malicious input that will perform code execution in the credentials during a login attempt.

Since this method does not create direct child processes or generate distinctive log entries, Sysmon and Log File detections are bypassed. In the case of network signature detection methods, they can be easily bypassed if the threat actor modifies the HTTP request by adding a slash or any random changes to it.

Although VulnCheck did not offer alternative detection techniques that are effective for all PoCs, they did issue a warning that hackers closely monitor detection techniques used by defenders and also modify their attacks to become undetected.

Thus, the best method to combat this attack is by applying the recommended security patches, which are for PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, and later.  

Read more »
Subscribe to: Posts (Atom)