Saturday, October 5, 2024
Homecyber securityHackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Hackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Published on

Since January 20, 2023, there have been several instances where malicious entities have been observed exploiting a significant security vulnerability in various Zoho ManageEngine products.

The vulnerability in question has been tracked by the security analysts at Bitdefender as “CVE-2022-47966” with a CVSS score of 9.8 and has been marked as “Critical.” 

As a result of this flaw, unauthenticated attackers will be able to completely take control of susceptible systems by executing code remotely, since it’s an RCE flaw.

- Advertisement - EHA

Affected Products

Currently, there are a total of 24 different Zoho ManageEngine products that are prone to this vulnerability. Here below we have mentioned them along with their patched versions:-

  • Access Manager Plus (4308)
  • Active Directory 360 (4310)
  • ADAudit Plus (7081)
  • ADManager Plus (7162)
  • ADSelfService Plus (6211)
  • Analytics Plus (5150)
  • Application Control Plus (10.1.2220.18)
  • Asset Explorer (6983)
  • Browser Security Plus (11.1.2238.6)
  • Device Control Plus  (10.1.2220.18)
  • Endpoint Central (10.1.2228.11)
  • Endpoint Central MSP (10.1.2228.11)
  • Endpoint DLP (10.1.2137.6)
  • Key Manager Plus (6401)
  • OS Deployer (1.1.2243.1
  • PAM 360 (5713)
  • Password Manager Pro (12124)
  • Patch Manager Plus (10.1.2220.18)
  • Remote Access Plus (10.1.2228.11)
  • Remote Monitoring and Management (RMM) (10.1.41)
  • ServiceDesk Plus (14004)
  • ServiceDesk Plus MSP (13001)
  • SupportCenter Plus (11026)
  • Vulnerability Manager Plus  (10.1.2220.18)

This vulnerability is attributed to the use of an outdated third-party dependency, Apache Santuario, for XML signature validation, which can be exploited by malicious actors.

While it has been claimed that the exploitation activities began the day following the release of a proof-of-concept (PoC) last month by the penetration testing company Horizon3.ai.

Attack Victims Geolocation

It has been reported that most of the victims of the attacks are from the following countries:-

  • Australia
  • Canada
  • Italy
  • Mexico
  • The Netherlands
  • Nigeria
  • Ukraine
  • The U.K.
  • The U.S.

Based on recent discoveries, it appears that the current wave of attacks is primarily targeting susceptible hosts with the aim of installing specialized tools, such as:-

  • Netcat 
  • Cobalt Strike Beacon

The initial access used in some of the breaches has been used to install AnyDesk software, which is a program that enables remote access to the network.

While the Windows versions of the notorious Buhti ransomware strain have been exploited in other breaches. Furthermore, the available evidence strongly suggests that malicious actors have exploited the ManageEngine vulnerability as part of a precisely targeted espionage campaign.

The attackers leveraged this weakness as an attack vector to distribute malware capable of executing subsequent stages of the attack.

In total the whole operation involves four clusters of attacks and here we have mentioned them:-

  • Cluster 1 – Initial Access Brokers
  • Cluster 2 – Buhti Ransomware
  • Cluster 3 – Cobalt Strike and RAT-el
  • Cluster 4 – Cyber espionage

Recommendations

As a result of this vulnerability, the importance of digital security has been highlighted once again. While here below we have mentioned all the security recommendations provided by the security experts:-

  • Make sure to always keep your system and software up-to-date with the latest available patches and security updates.
  • Ensure to implement a strong perimeter of defense.
  • Make sure to have a proper patch management and risk management system.
  • Implement multi-layered protection on all the endpoints and servers.
  • The most effective way to defeat automated vulnerability exploits is to establish IP reputation, domain reputation, and URL reputation.
  • It is highly recommended that organizations, regardless of their size, implement comprehensive detection and response capabilities.

Network Security Checklist – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam

A new ransomware campaign targeting individuals and organizations in the UK and the US...

Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group

Microsoft and the U.S. Department of Justice (DOJ) have successfully dismantled a network of...

Cloud Penetration Testing Checklist – 2024

Cloud Penetration Testing is a method of actively checking and examining the Cloud system...

Linux Malware perfctl Attacking Millions of Linux Servers

Researchers have uncovered a sophisticated Linux malware, dubbed "perfctl," actively targeting millions of Linux...

Free Webinar

Decoding Compliance | What CISOs Need to Know

Non-compliance can result in substantial financial penalties, with average fines reaching up to $4.5 million for GDPR breaches alone.

Join us for an insightful panel discussion with Chandan Pani, CISO - LTIMindtree and Ashish Tandon, Founder & CEO – Indusface, as we explore the multifaceted role of compliance in securing modern enterprises.

Discussion points

The Role of Compliance
The Alphabet Soup of Compliance
Compliance
SaaS and Compliance
Indusface's Approach to Compliance

More like this

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam

A new ransomware campaign targeting individuals and organizations in the UK and the US...

Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group

Microsoft and the U.S. Department of Justice (DOJ) have successfully dismantled a network of...

Linux Malware perfctl Attacking Millions of Linux Servers

Researchers have uncovered a sophisticated Linux malware, dubbed "perfctl," actively targeting millions of Linux...