Saturday, June 15, 2024

Hackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Since January 20, 2023, there have been several instances where malicious entities have been observed exploiting a significant security vulnerability in various Zoho ManageEngine products.

The vulnerability in question has been tracked by the security analysts at Bitdefender as “CVE-2022-47966” with a CVSS score of 9.8 and has been marked as “Critical.” 

As a result of this flaw, unauthenticated attackers will be able to completely take control of susceptible systems by executing code remotely, since it’s an RCE flaw.

Affected Products

Currently, there are a total of 24 different Zoho ManageEngine products that are prone to this vulnerability. Here below we have mentioned them along with their patched versions:-

  • Access Manager Plus (4308)
  • Active Directory 360 (4310)
  • ADAudit Plus (7081)
  • ADManager Plus (7162)
  • ADSelfService Plus (6211)
  • Analytics Plus (5150)
  • Application Control Plus (10.1.2220.18)
  • Asset Explorer (6983)
  • Browser Security Plus (11.1.2238.6)
  • Device Control Plus  (10.1.2220.18)
  • Endpoint Central (10.1.2228.11)
  • Endpoint Central MSP (10.1.2228.11)
  • Endpoint DLP (10.1.2137.6)
  • Key Manager Plus (6401)
  • OS Deployer (1.1.2243.1
  • PAM 360 (5713)
  • Password Manager Pro (12124)
  • Patch Manager Plus (10.1.2220.18)
  • Remote Access Plus (10.1.2228.11)
  • Remote Monitoring and Management (RMM) (10.1.41)
  • ServiceDesk Plus (14004)
  • ServiceDesk Plus MSP (13001)
  • SupportCenter Plus (11026)
  • Vulnerability Manager Plus  (10.1.2220.18)

This vulnerability is attributed to the use of an outdated third-party dependency, Apache Santuario, for XML signature validation, which can be exploited by malicious actors.

While it has been claimed that the exploitation activities began the day following the release of a proof-of-concept (PoC) last month by the penetration testing company

Attack Victims Geolocation

It has been reported that most of the victims of the attacks are from the following countries:-

  • Australia
  • Canada
  • Italy
  • Mexico
  • The Netherlands
  • Nigeria
  • Ukraine
  • The U.K.
  • The U.S.

Based on recent discoveries, it appears that the current wave of attacks is primarily targeting susceptible hosts with the aim of installing specialized tools, such as:-

  • Netcat 
  • Cobalt Strike Beacon

The initial access used in some of the breaches has been used to install AnyDesk software, which is a program that enables remote access to the network.

While the Windows versions of the notorious Buhti ransomware strain have been exploited in other breaches. Furthermore, the available evidence strongly suggests that malicious actors have exploited the ManageEngine vulnerability as part of a precisely targeted espionage campaign.

The attackers leveraged this weakness as an attack vector to distribute malware capable of executing subsequent stages of the attack.

In total the whole operation involves four clusters of attacks and here we have mentioned them:-

  • Cluster 1 – Initial Access Brokers
  • Cluster 2 – Buhti Ransomware
  • Cluster 3 – Cobalt Strike and RAT-el
  • Cluster 4 – Cyber espionage


As a result of this vulnerability, the importance of digital security has been highlighted once again. While here below we have mentioned all the security recommendations provided by the security experts:-

  • Make sure to always keep your system and software up-to-date with the latest available patches and security updates.
  • Ensure to implement a strong perimeter of defense.
  • Make sure to have a proper patch management and risk management system.
  • Implement multi-layered protection on all the endpoints and servers.
  • The most effective way to defeat automated vulnerability exploits is to establish IP reputation, domain reputation, and URL reputation.
  • It is highly recommended that organizations, regardless of their size, implement comprehensive detection and response capabilities.

Network Security Checklist – Download Free E-Book


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles