Lace Tempest

Lace Tempest is a financially motivated cybercrime threat actor tracked by Microsoft and widely associated with the Cl0p ransomware and extortion ecosystem. The actor’s activity overlaps with clusters commonly referred to as FIN11 and TA505, and it has been linked to large-scale data theft, extortion, and ransomware deployment. Lace Tempest has been observed operating both as a ransomware affiliate and as an intrusion actor that exploits high-value enterprise software vulnerabilities for initial access, followed by data exfiltration and, in some cases, ransomware deployment. Lace Tempest is notable for opportunistic exploitation of internet-facing enterprise applications, particularly managed file transfer, print management, and IT service management platforms. Publicly linked operations include exploitation of vulnerabilities in MOVEit Transfer, PaperCut MF/NG, and SysAid on-premises software. In these campaigns, the actor used zero-day or newly disclosed vulnerabilities to gain access, deploy webshells or loaders, establish persistence, and steal data at scale. The MOVEit campaign was especially significant, aligning Lace Tempest with the Cl0p extortion model centered on mass exploitation and theft-driven extortion rather than solely encryption. Observed post-compromise tradecraft includes deployment of malware and tooling such as TrueBot, Cobalt Strike, Gracewire, FlawedGrace, and other loaders or implants associated with financially motivated intrusion sets. Reported behaviors include use of webshells for persistence, command execution through compromised application servers, lateral movement, staging and exfiltration of victim data, and delivery of ransomware payloads including Cl0p and, in some intrusions, LockBit. Lace Tempest has also been associated with extortion operations tied to stolen data and operation of the Cl0p leak site. The actor is part of the broader ransomware-as-a-service and cybercrime ecosystem and has been identified as one of the more notable ransomware affiliates. Microsoft has tracked the group under the temporary designation DEV-0950 before publicly naming it Lace Tempest. Lace Tempest has also been described as cooperating at times with other financially motivated actors, including overlap or collaboration involving Sangria Tempest. The group is not a nation-state actor; its operations are assessed as criminal and profit-driven, with targeting shaped primarily by vulnerable enterprise software and extortion opportunity rather than geopolitical objectives.