Thursday, March 28, 2024

Hackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Since January 20, 2023, there have been several instances where malicious entities have been observed exploiting a significant security vulnerability in various Zoho ManageEngine products.

The vulnerability in question has been tracked by the security analysts at Bitdefender as “CVE-2022-47966” with a CVSS score of 9.8 and has been marked as “Critical.” 

As a result of this flaw, unauthenticated attackers will be able to completely take control of susceptible systems by executing code remotely, since it’s an RCE flaw.

Affected Products

Currently, there are a total of 24 different Zoho ManageEngine products that are prone to this vulnerability. Here below we have mentioned them along with their patched versions:-

  • Access Manager Plus (4308)
  • Active Directory 360 (4310)
  • ADAudit Plus (7081)
  • ADManager Plus (7162)
  • ADSelfService Plus (6211)
  • Analytics Plus (5150)
  • Application Control Plus (10.1.2220.18)
  • Asset Explorer (6983)
  • Browser Security Plus (11.1.2238.6)
  • Device Control Plus  (10.1.2220.18)
  • Endpoint Central (10.1.2228.11)
  • Endpoint Central MSP (10.1.2228.11)
  • Endpoint DLP (10.1.2137.6)
  • Key Manager Plus (6401)
  • OS Deployer (1.1.2243.1
  • PAM 360 (5713)
  • Password Manager Pro (12124)
  • Patch Manager Plus (10.1.2220.18)
  • Remote Access Plus (10.1.2228.11)
  • Remote Monitoring and Management (RMM) (10.1.41)
  • ServiceDesk Plus (14004)
  • ServiceDesk Plus MSP (13001)
  • SupportCenter Plus (11026)
  • Vulnerability Manager Plus  (10.1.2220.18)

This vulnerability is attributed to the use of an outdated third-party dependency, Apache Santuario, for XML signature validation, which can be exploited by malicious actors.

While it has been claimed that the exploitation activities began the day following the release of a proof-of-concept (PoC) last month by the penetration testing company Horizon3.ai.

Attack Victims Geolocation

It has been reported that most of the victims of the attacks are from the following countries:-

  • Australia
  • Canada
  • Italy
  • Mexico
  • The Netherlands
  • Nigeria
  • Ukraine
  • The U.K.
  • The U.S.

Based on recent discoveries, it appears that the current wave of attacks is primarily targeting susceptible hosts with the aim of installing specialized tools, such as:-

  • Netcat 
  • Cobalt Strike Beacon

The initial access used in some of the breaches has been used to install AnyDesk software, which is a program that enables remote access to the network.

While the Windows versions of the notorious Buhti ransomware strain have been exploited in other breaches. Furthermore, the available evidence strongly suggests that malicious actors have exploited the ManageEngine vulnerability as part of a precisely targeted espionage campaign.

The attackers leveraged this weakness as an attack vector to distribute malware capable of executing subsequent stages of the attack.

In total the whole operation involves four clusters of attacks and here we have mentioned them:-

  • Cluster 1 – Initial Access Brokers
  • Cluster 2 – Buhti Ransomware
  • Cluster 3 – Cobalt Strike and RAT-el
  • Cluster 4 – Cyber espionage

Recommendations

As a result of this vulnerability, the importance of digital security has been highlighted once again. While here below we have mentioned all the security recommendations provided by the security experts:-

  • Make sure to always keep your system and software up-to-date with the latest available patches and security updates.
  • Ensure to implement a strong perimeter of defense.
  • Make sure to have a proper patch management and risk management system.
  • Implement multi-layered protection on all the endpoints and servers.
  • The most effective way to defeat automated vulnerability exploits is to establish IP reputation, domain reputation, and URL reputation.
  • It is highly recommended that organizations, regardless of their size, implement comprehensive detection and response capabilities.

Network Security Checklist – Download Free E-Book

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles