Feb 23, 2023Ravie Lakshmanan

Multiple threat actors have been observed opportunistically weaponizing a now-patched critical security vulnerability impacting several Zoho ManageEngine products since January 20, 2023.

Tracked as CVE-2022-47966 (CVSS score: 9.8), the remote code execution flaw allows a complete takeover of the susceptible systems by unauthenticated attackers.

As many as 24 different products, including Access Manager Plus, ADManager Plus, ADSelfService Plus, Password Manager Pro, Remote Access Plus, and Remote Monitoring and Management (RMM), are affected by the issue.

The shortcoming “allows unauthenticated remote code execution due to usage of an outdated third-party dependency for XML signature validation, Apache Santuario,” Bitdefender’s Martin Zugec said in a technical advisory shared with The Hacker News.

According to the Romanian cybersecurity firm, the exploitation efforts are said to have commenced the day after penetration testing firm Horizon3.ai released a proof-of-concept (PoC) last month.

A majority of the attack victims are located in Australia, Canada, Italy, Mexico, the Netherlands, Nigeria, Ukraine, the U.K., and the U.S.

The main objective of the attacks detected to date revolves around deploying tools on vulnerable hosts such as Netcat and Cobalt Strike Beacon.

Some intrusions have leveraged the initial access to install AnyDesk software for remote access, while a few others have attempted to install a Windows version of a ransomware strain known as Buhti.

What’s more, evidence points to the abuse of the ManageEngine flaw in a targeted espionage operation, with the threat actors using it as an attack vector to deploy malware capable of executing next-stage payloads.

“This vulnerability is another clear reminder of the importance of keeping systems up to date with the latest security patches while also employing strong perimeter defense,” Zugec said.

“Attackers don’t need to scour for new exploits or novel techniques when they know that many organizations are vulnerable to older exploits due, in part, to the lack of proper patch management and risk management.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Roman Alexander Finds Love on ‘Bourbon Street’
Gonzaga vs. UConn Livestream: How to Watch the March Madness Game Online for Free
‘It Could Happen at Any School’: Remembering Nashville Students, Faculty Killed in Covenant Shooting
Willie Nelson’s Vintage 1974 Performance Of Some Of His Biggest Hits Is Pure Country Perfection
Barclays-backed Bink secures lifeline with £9m funding round

Leave a Reply

Your email address will not be published. Required fields are marked *