Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products

Feb 23, 2023Ravie Lakshmanan

Multiple threat actors have been observed opportunistically
weaponizing a now-patched critical security vulnerability impacting
several Zoho ManageEngine products since January 20, 2023.

Tracked as CVE-2022-47966 (CVSS score: 9.8),
the remote code execution flaw^[1] allows a complete
takeover of the susceptible systems by unauthenticated
attackers.

As many as 24 different products^[2], including Access
Manager Plus, ADManager Plus, ADSelfService Plus, Password Manager
Pro, Remote Access Plus, and Remote Monitoring and Management
(RMM), are affected by the issue.

The shortcoming “allows unauthenticated remote code execution
due to usage of an outdated third-party dependency for XML
signature validation, Apache Santuario,” Bitdefender’s Martin Zugec
said^[3]
in a technical advisory shared with The Hacker News.

According to the Romanian cybersecurity firm, the exploitation
efforts are said to have commenced the day after penetration
testing firm Horizon3.ai released a proof-of-concept (PoC) last
month.

A majority of the attack victims are located in Australia,
Canada, Italy, Mexico, the Netherlands, Nigeria, Ukraine, the U.K.,
and the U.S.

The main objective of the attacks detected to date revolves
around deploying tools on vulnerable hosts such as Netcat and
Cobalt Strike Beacon.

Some intrusions have leveraged the initial access to install
AnyDesk software for remote access, while a few others have
attempted to install a Windows version of a ransomware strain known
as Buhti^[4].

What’s more, there is evidence of a targeted espionage operation^[5], with the threat actors
abusing the ManageEngine flaw to deploy malware capable of
executing next-stage payloads.

“This vulnerability is another clear reminder of the importance
of keeping systems up to date with the latest security patches
while also employing strong perimeter defense,” Zugec said.

“Attackers don’t need to scour for new exploits or novel
techniques when they know that many organizations are vulnerable to
older exploits due, in part, to the lack of proper patch management
and risk management.”