Hackers Weaponizing New Critical Flaw to Attack Zoho ManageEngine Products

Since January 20, 2023, there have been several instances where malicious entities have been observed exploiting a significant security vulnerability in various Zoho ManageEngine products.

The vulnerability in question has been tracked by the security analysts at Bitdefender as “CVE-2022-47966” with a CVSS score of 9.8 and has been marked as “Critical.” 

As a result of this flaw, unauthenticated attackers will be able to completely take control of susceptible systems by executing code remotely, since it’s an RCE flaw.

Affected Products

Currently, there are a total of 24 different Zoho ManageEngine products that are prone to this vulnerability. Here below we have mentioned them along with their patched versions:-

• Access Manager Plus (4308)
• Active Directory 360 (4310)
• ADAudit Plus (7081)
• ADManager Plus (7162)
• ADSelfService Plus (6211)
• Analytics Plus (5150)
• Application Control Plus (10.1.2220.18)
• Asset Explorer (6983)
• Browser Security Plus (11.1.2238.6)
• Device Control Plus  (10.1.2220.18)
• Endpoint Central (10.1.2228.11)
• Endpoint Central MSP (10.1.2228.11)
• Endpoint DLP (10.1.2137.6)
• Key Manager Plus (6401)
• OS Deployer (1.1.2243.1
• PAM 360 (5713)
• Password Manager Pro (12124)
• Patch Manager Plus (10.1.2220.18)
• Remote Access Plus (10.1.2228.11)
• Remote Monitoring and Management (RMM) (10.1.41)
• ServiceDesk Plus (14004)
• ServiceDesk Plus MSP (13001)
• SupportCenter Plus (11026)
• Vulnerability Manager Plus  (10.1.2220.18)

This vulnerability is attributed to the use of an outdated third-party dependency, Apache Santuario, for XML signature validation, which can be exploited by malicious actors.

While it has been claimed that the exploitation activities began the day following the release of a proof-of-concept (PoC) last month by the penetration testing company Horizon3.ai.

Attack Victims Geolocation

It has been reported that most of the victims of the attacks are from the following countries:-

• Australia
• Canada
• Italy
• Mexico
• The Netherlands
• Nigeria
• Ukraine
• The U.K.
• The U.S.

Based on recent discoveries, it appears that the current wave of attacks is primarily targeting susceptible hosts with the aim of installing specialized tools, such as:-

• Netcat
• Cobalt Strike Beacon

The initial access used in some of the breaches has been used to install AnyDesk software, which is a program that enables remote access to the network.

While the Windows versions of the notorious Buhti ransomware strain have been exploited in other breaches. Furthermore, the available evidence strongly suggests that malicious actors have exploited the ManageEngine vulnerability as part of a precisely targeted espionage campaign.

The attackers leveraged this weakness as an attack vector to distribute malware capable of executing subsequent stages of the attack.

In total the whole operation involves four clusters of attacks and here we have mentioned them:-

• Cluster 1 – Initial Access Brokers
• Cluster 2 – Buhti Ransomware
• Cluster 3 – Cobalt Strike and RAT-el
• Cluster 4 – Cyber espionage

Recommendations

As a result of this vulnerability, the importance of digital security has been highlighted once again. While here below we have mentioned all the security recommendations provided by the security experts:-

• Make sure to always keep your system and software up-to-date with the latest available patches and security updates.
• Ensure to implement a strong perimeter of defense.
• Make sure to have a proper patch management and risk management system.
• Implement multi-layered protection on all the endpoints and servers.
• The most effective way to defeat automated vulnerability exploits is to establish IP reputation, domain reputation, and URL reputation.
• It is highly recommended that organizations, regardless of their size, implement comprehensive detection and response capabilities.

Network Security Checklist – Download Free E-Book