Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products

Cyber Security

Products You May Like

Feb 23, 2023Ravie Lakshmanan

Multiple threat actors have been observed opportunistically weaponizing a now-patched critical security vulnerability impacting several Zoho ManageEngine products since January 20, 2023.

Tracked as CVE-2022-47966 (CVSS score: 9.8), the remote code execution flaw allows a complete takeover of the susceptible systems by unauthenticated attackers.

As many as 24 different products, including Access Manager Plus, ADManager Plus, ADSelfService Plus, Password Manager Pro, Remote Access Plus, and Remote Monitoring and Management (RMM), are affected by the issue.

The shortcoming “allows unauthenticated remote code execution due to usage of an outdated third-party dependency for XML signature validation, Apache Santuario,” Bitdefender’s Martin Zugec said in a technical advisory shared with The Hacker News.

According to the Romanian cybersecurity firm, the exploitation efforts are said to have commenced the day after penetration testing firm Horizon3.ai released a proof-of-concept (PoC) last month.

A majority of the attack victims are located in Australia, Canada, Italy, Mexico, the Netherlands, Nigeria, Ukraine, the U.K., and the U.S.

The main objective of the attacks detected to date revolves around deploying tools on vulnerable hosts such as Netcat and Cobalt Strike Beacon.

Some intrusions have leveraged the initial access to install AnyDesk software for remote access, while a few others have attempted to install a Windows version of a ransomware strain known as Buhti.

What’s more, there is evidence of a targeted espionage operation, with the threat actors abusing the ManageEngine flaw to deploy malware capable of executing next-stage payloads.

“This vulnerability is another clear reminder of the importance of keeping systems up to date with the latest security patches while also employing strong perimeter defense,” Zugec said.

“Attackers don’t need to scour for new exploits or novel techniques when they know that many organizations are vulnerable to older exploits due, in part, to the lack of proper patch management and risk management.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Apple Watch Series 10 Design Revealed in Alleged CAD Renders; Tipped to Get 2-Inch Display
Vivo T3 Lite 5G With 50-Megapixel Main Camera, IP64-Rated Build Launched in India: Price, Specifications
iOS 18, iPadOS 18 Developer Beta Users Can Now Format External Drives Via Files App
Meta Quest Tipped to Gain Support for Free Window Placement Feature Found on Apple Vision Pro
Truecaller Fraud Insurance Launched in India for iOS and Android Users

Leave a Reply

Your email address will not be published. Required fields are marked *