Experts Detail Malicious Code Dropped Using ManageEngine ADSelfService Exploit

At least nine entities across the technology, defense,
healthcare, energy, and education industries were compromised by
leveraging a recently patched critical
vulnerability^[1]
in Zoho’s ManageEngine ADSelfService Plus self-service password
management and single sign-on (SSO) solution.

The spying campaign, which was observed starting September 22,
2021, involved the threat actor taking advantage of the flaw to
gain initial access to targeted organizations, before moving
laterally through the network to carry out post-exploitation
activities by deploying malicious tools designed to harvest
credentials and exfiltrate sensitive information via a
backdoor.

“The actor heavily relies on the Godzilla web shell, uploading
several variations of the open-source web shell to the compromised
server over the course of the operation,” researchers from Palo
Alto Networks’ Unit 42 threat intelligence team said^[2]
in a report. “Several other tools have novel characteristics or
have not been publicly discussed as being used in previous attacks,
specifically the NGLite backdoor and the KdcSponge stealer.”

Tracked as CVE-2021-40539^[3], the vulnerability
relates to an authentication bypass vulnerability affecting
REST API^[4]
URLs that could enable remote code execution, prompting the U.S.
Cybersecurity and Infrastructure Security Agency (CISA) to warn of
active exploitation attempts in the wild. The security shortcoming
has been rated 9.8 out of 10 in severity.

Real-world attacks weaponizing the bug are said to have
commenced as early as August 2021, according to CISA, the U.S.
Federal Bureau of Investigation (FBI), and the Coast Guard Cyber
Command (CGCYBER).

Unit 42’s investigation into the attack campaign found that
successful initial exploitation was followed by the installation of
a Chinese-language JSP web shell named “Godzilla^[5],” with select victims
also infected with a custom Golang-based open-source Trojan called
“NGLite^[6].”

“NGLite is characterized by its author as an ‘anonymous
cross-platform remote control program based on blockchain
technology,'” researchers Robert Falcone, Jeff White, and Peter
Renals explained. “It leverages New Kind of Network (NKN^[7]) infrastructure for its
command and control (C2) communications, which theoretically
results in anonymity for its users.”

In subsequent steps, the toolset enabled the attacker to run
commands and move laterally to other systems on the network, while
simultaneously transmitting files of interest. Also deployed in the
kill chain is a novel password-stealer dubbed “KdcSponge”
orchestrated to steal credentials from domain controllers.

Ultimately, the adversary is believed to have targeted at least
370 Zoho ManageEngine servers in the U.S. alone beginning September
17. While the identity of the threat actor remains unclear, Unit 42
said it observed correlations in tactics and
tooling^[8] between the attacker and
that of Emissary Panda^[9]
(aka APT27, TG-3390, BRONZE UNION, Iron Tiger, or LuckyMouse).

“Organizations that identify any activity related to
ManageEngine ADSelfService Plus indicators of compromise within
their networks should take action immediately,” CISA said^[10], in addition to
recommending “domain-wide password resets and double Kerberos
Ticket Granting Ticket (TGT) password resets if any indication is
found that the ‘NTDS.dit^[11]‘ file was
compromised.”