Loading story…
PaperCut disclosed an urgent security bulletin for its MF/NG products after vulnerabilities tracked as PO-1216 and PO-1219 were identified, with patches made available in March 2023. Subsequent reporting said the flaws had been reported earlier by Trend Micro and affected internet-exposed print management servers, prompting organizations to update systems immediately.
Ransomware operators, including actors linked to CL0P and other groups, were later reported exploiting the PaperCut vulnerabilities during intrusions, adding the bugs to a broader surge in ransomware activity. Separate April 2023 ransomware tracking also noted continued high victim volumes globally, with LockBit leading leak-site postings and AlphV/BlackCat and BianLian increasing activity, underscoring how quickly newly disclosed enterprise software flaws were being weaponized.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
A new Nokoyawa leak site was identified in late May 2023. The article contrasts this with the group's original leak site being inaccessible as of May 2023.
Microsoft released a patch for the Windows CLFS zero-day CVE-2023-28252 on April 11, 2023 as part of its monthly security updates. The flaw had been exploited in attacks tied to attempted Nokoyawa deployment.
Japan recorded 9 ransomware victim cases in April 2023, placing it in the global top 10 victim countries for the month and first in Asia. Of those Japan-related leak-site postings, 5 were attributed to LockBit and 2 to Royal.
In late April 2023, Microsoft Threat Intelligence warned that CL0P-linked actors were exploiting vulnerabilities in PaperCut NG/MF. The article also notes that Bl00dy ransomware exploited the same vulnerabilities.
AKIRA appeared among the top 10 ransomware groups after its leak site was discovered in early April 2023. This indicated the arrival of another newly observed ransomware operation.
The Zero Day Initiative registered the PaperCut vulnerability on March 14, 2023. This marked a further public milestone in the vulnerability's disclosure timeline.
PaperCut released patches for the affected NG/MF vulnerabilities by March 8, 2023. Despite patch availability, exploitation continued afterward.
Money Message entered the top 10 ransomware groups after its leak site was discovered in late March 2023. Its emergence reflected the appearance of a new active ransomware brand.
Kaspersky observed exploitation of the Windows Common Log File System vulnerability CVE-2023-28252 beginning in February 2023. Attackers used the flaw for privilege escalation before attempting to deploy Nokoyawa ransomware.
The PaperCut NG/MF vulnerabilities were reported to PaperCut by Trend Micro in January 2023. This disclosure preceded later patching and subsequent exploitation by ransomware actors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security agencies warned that multiple vulnerabilities in **PaperCut MF** and **PaperCut NG** can expose organizations to serious compromise, including the actively exploited flaw **`CVE-2023-27350`**. CISA previously reported that malicious actors were exploiting the vulnerability in the wild, allowing unauthenticated attackers to gain remote access to vulnerable PaperCut application servers and potentially execute code, making internet-exposed print management systems a high-risk target. A later security bulletin from HKCERT highlighted additional PaperCut vulnerabilities, reinforcing ongoing risk around the platform and the need for prompt remediation. Together, the advisories indicate that unpatched PaperCut deployments remain attractive entry points for attackers, with affected organizations urged to review vendor guidance, apply available updates, and assess exposed servers for signs of compromise.
Jun 29, 2026
Researchers detailed how ransomware operators linked to **LockBit** exploited Citrix NetScaler ADC and Gateway appliances through the original **CitrixBleed** flaw, `CVE-2023-4966`, using stolen session data to support follow-on access and affiliate infrastructure operations. An OSINT analysis built from joint government and Boeing-published indicators identified additional suspected LockBit infrastructure spanning command-and-control, remote management, FTP, RDP, and OpenVPN services, with recurring hosting patterns and overlaps with tooling and infrastructure previously associated with **Akira**, **Avaddon**, **Cerber**, **BumbleBee**, **Raccoon Stealer**, **RecordBreaker**, **SolarMarker**, **8Base**, and **ShadowSyndicate**. A later root-cause analysis of **CitrixBleed 2**, `CVE-2025-5777`, showed that a malformed POST request to `/p/u/doAuthentication.do` can trigger an out-of-bounds memory disclosure on vulnerable NetScaler devices, leaking up to `0x7F` bytes per request in an authentication failure response. Researchers warned that exposed memory may include credentials, session cookies, and private keys, making the bug a low-noise path to unauthenticated access similar in impact to the earlier CitrixBleed incidents; Citrix issued fixes and defenders were urged to patch immediately, invalidate sessions, reset credentials, rotate certificates and secrets where needed, and review telemetry for LockBit-related indicators, while broad community IOC feeds for suspected **LockBit 5.0** activity have also circulated with explicit false-positive caveats.
Jun 29, 2026
Threat actors continue to prioritize internet-facing infrastructure that provides high-leverage initial access, with multiple reports highlighting **active exploitation of remote code execution (RCE) paths** in widely deployed services. A DFIR case study described attackers exploiting **Apache ActiveMQ** `CVE-2023-46604` by sending a crafted OpenWire command that forced the broker to load a remote Spring XML configuration, leading to payload retrieval via `certutil`, rapid privilege escalation to **SYSTEM**, credential dumping from **LSASS**, and eventual **LockBit** ransomware deployment via **RDP** after re-entry using previously stolen privileged credentials. Separately, incident-response reporting warned of ongoing exploitation against **Managed File Transfer (MFT)** products, including Gladinet *CentreStack* (an LFI issue `CVE-2025-11371` used in an exploit chain culminating in RCE, patched as `CVE-2025-30406`) and Fortra *GoAnywhere MFT* (`CVE-2025-10035`, improper deserialization leading to RCE), with observed activity linked to a threat group associated with **Medusa** ransomware. Broader telemetry and research reinforced that edge and externally exposed services remain the primary battleground for initial access at scale. GreyNoise reported nearly **3 billion** malicious sessions against edge infrastructure in 2H 2025, with heavy targeting of enterprise VPNs (notably **Palo Alto GlobalProtect**) and continued exploitation attempts for older issues such as `CVE-2020-2034`, alongside pervasive scanning of **SSH** and remote access services. In parallel, financially motivated and cybercrime-enabling ecosystems are improving their ability to reach victims: Varonis detailed **1Campaign**, a cloaking service that helps malicious **Google Ads** evade review by serving benign pages to scanners while directing real users to phishing/crypto-drainer content, and Have I Been Squatted documented **Diesel Vortex**, a logistics-focused credential-phishing operation using dozens of domains and an exposed backend repository to support industrialized theft. These trends align with reporting that attackers are increasingly using **AI-assisted social engineering and tooling** (including deepfakes and AI-generated phishing) and with law-enforcement actions such as Interpol-backed **Operation Red Card 2.0**, which resulted in **651 arrests** and $4.3M recovered from cyber-enabled fraud activity across 16 African countries.
Jun 29, 2026