DEV-0950

MISP

Type:
Unknown

Country:
Unknown

First seen:
Unknown

Details:

Lace Tempest, also known as DEV-0950, is a threat actor that exploited vulnerabilities in software such as SysAid and PaperCut to gain unauthorized access to systems. Lace Tempest is known for deploying the Clop ransomware and exfiltrating data from compromised networks.

References (1)

microsoft.com - Raspberry Robin Worm Part Of Larger Ecosystem Facilitating Pre Ransomware Activity

Aliases (106)

Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest Lace Tempest

Metadata

ID:	494
Created:	13/01/2026 17:48
Updated:	07/03/2026 16:00