Monday, March 4, 2024

Hackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Since January 20, 2023, there have been several instances where malicious entities have been observed exploiting a significant security vulnerability in various Zoho ManageEngine products.

The vulnerability in question has been tracked by the security analysts at Bitdefender as “CVE-2022-47966” with a CVSS score of 9.8 and has been marked as “Critical.” 

As a result of this flaw, unauthenticated attackers will be able to completely take control of susceptible systems by executing code remotely, since it’s an RCE flaw.

Affected Products

Currently, there are a total of 24 different Zoho ManageEngine products that are prone to this vulnerability. Here below we have mentioned them along with their patched versions:-

  • Access Manager Plus (4308)
  • Active Directory 360 (4310)
  • ADAudit Plus (7081)
  • ADManager Plus (7162)
  • ADSelfService Plus (6211)
  • Analytics Plus (5150)
  • Application Control Plus (10.1.2220.18)
  • Asset Explorer (6983)
  • Browser Security Plus (11.1.2238.6)
  • Device Control Plus  (10.1.2220.18)
  • Endpoint Central (10.1.2228.11)
  • Endpoint Central MSP (10.1.2228.11)
  • Endpoint DLP (10.1.2137.6)
  • Key Manager Plus (6401)
  • OS Deployer (1.1.2243.1
  • PAM 360 (5713)
  • Password Manager Pro (12124)
  • Patch Manager Plus (10.1.2220.18)
  • Remote Access Plus (10.1.2228.11)
  • Remote Monitoring and Management (RMM) (10.1.41)
  • ServiceDesk Plus (14004)
  • ServiceDesk Plus MSP (13001)
  • SupportCenter Plus (11026)
  • Vulnerability Manager Plus  (10.1.2220.18)

This vulnerability is attributed to the use of an outdated third-party dependency, Apache Santuario, for XML signature validation, which can be exploited by malicious actors.

While it has been claimed that the exploitation activities began the day following the release of a proof-of-concept (PoC) last month by the penetration testing company

Attack Victims Geolocation

It has been reported that most of the victims of the attacks are from the following countries:-

  • Australia
  • Canada
  • Italy
  • Mexico
  • The Netherlands
  • Nigeria
  • Ukraine
  • The U.K.
  • The U.S.

Based on recent discoveries, it appears that the current wave of attacks is primarily targeting susceptible hosts with the aim of installing specialized tools, such as:-

  • Netcat 
  • Cobalt Strike Beacon

The initial access used in some of the breaches has been used to install AnyDesk software, which is a program that enables remote access to the network.

While the Windows versions of the notorious Buhti ransomware strain have been exploited in other breaches. Furthermore, the available evidence strongly suggests that malicious actors have exploited the ManageEngine vulnerability as part of a precisely targeted espionage campaign.

The attackers leveraged this weakness as an attack vector to distribute malware capable of executing subsequent stages of the attack.

In total the whole operation involves four clusters of attacks and here we have mentioned them:-

  • Cluster 1 – Initial Access Brokers
  • Cluster 2 – Buhti Ransomware
  • Cluster 3 – Cobalt Strike and RAT-el
  • Cluster 4 – Cyber espionage


As a result of this vulnerability, the importance of digital security has been highlighted once again. While here below we have mentioned all the security recommendations provided by the security experts:-

  • Make sure to always keep your system and software up-to-date with the latest available patches and security updates.
  • Ensure to implement a strong perimeter of defense.
  • Make sure to have a proper patch management and risk management system.
  • Implement multi-layered protection on all the endpoints and servers.
  • The most effective way to defeat automated vulnerability exploits is to establish IP reputation, domain reputation, and URL reputation.
  • It is highly recommended that organizations, regardless of their size, implement comprehensive detection and response capabilities.

Network Security Checklist – Download Free E-Book


Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles