Security Researchers has found an exploit to bypass detection for PaperCut Vulnerability.

PaperCut received the report from a customer of suspicious activity on their PaperCut server on the 18th of April.

Tracked as CVE - 2023 - 27350, CVSS score: 9.8 (Critical) enabled remote code execution vulnerability that could lead to exploit by unauthorized attacker to execute arbitrary code with SYSTEM privilege's.

The earliest signature of suspicious activity the customer server was linked to this vulnerability on April 13th.

"We've had report of customers being late to patch, and as a result their server have been exposed for a number of weeks" says Chris Dance, PaperCut CEO

The flaws have been patched by an Australian Company on the 8th of March. Since then, the vulnerability has been weaponized by multiple threads grops, including ransomware actors, with post-exploitations resulting in the execution of Powershell commands, designed to drop additional payloads.