CVE-2023-47246

Attackers exploited the SysAid CVE-2023-47246 path traversal to upload a WAR webshell to the Tomcat webroot, used PowerShell to install and launch the GraceWire loader which decrypts a .bin payload and injects a trojan into processes (spoolsv.exe, msiexec.exe, svchost.exe), and executed cleanup scripts to remove evidence; the report also links related exploitation activity (CobaltStrike download command and CL0P references) and provides actionable IOCs.