Microsoft Warns of Uptick in Hackers Leveraging Publicly-Disclosed 0-Day Vulnerabilities

Microsoft is warning of an uptick in the nation-state and
criminal actors increasingly leveraging publicly-disclosed zero-day
vulnerabilities for breaching target environments.

The tech giant, in its 114-page Digital Defense Report^[1], said it has “observed a
reduction in the time between the announcement of a vulnerability
and the commoditization of that vulnerability,” making it
imperative that organizations patch such exploits in a timely
manner.

This also corroborates an April 2022 advisory from the U.S.
Cybersecurity and Infrastructure Security Agency (CISA), which
found^[2]
that bad actors are “aggressively” targeting newly disclosed
software bugs against broad targets globally.

Microsoft noted that it only takes 14 days on average for an
exploit to be available in the wild after public disclosure of a
flaw, stating that while zero-day attacks are initially limited in
scope, they tend to be swiftly adopted by other threat actors,
leading to indiscriminate probing events before the patches are
installed.

It further accused Chinese state-sponsored groups of being
“particularly proficient” at discovering and developing zero-day
exploits.

This has been compounded by the fact that the Cyberspace
Administration of China (CAC) enacted a new vulnerability reporting
regulation^[3] in September 2021 that
requires security flaws to be reported to the government prior to
them being shared with the product developers.

Redmond further said the law could enable government-backed
elements to stockpile and weaponize the reported bugs, leading to
the increased use of zero-days for espionage activities designed to
advance its economic and military interests.

Some of the vulnerabilities that were first exploited by Chinese
actors before being picked up other adversarial groups include
–

• CVE-2021-35211^[4] (CVSS score: 10.0) – A
  remote code execution flaw in SolarWinds Serv-U Managed File
  Transfer Server and Serv-U Secure FTP software that was exploited
  by DEV-0322.
• CVE-2021-40539^[5] (CVSS score: 9.8) – An
  authentication bypass flaw in Zoho ManageEngine ADSelfService Plus
  that was exploited by DEV-0322 (TiltedTemple).
• CVE-2021-44077^[6] (CVSS score: 9.8) – An
  unauthenticated remote code execution flaw in Zoho ManageEngine
  ServiceDesk Plus that was exploited by DEV-0322
  (TiltedTemple).
• CVE-2021-42321^[7] (CVSS score: 8.8) – A
  remote code execution flaw in Microsoft Exchange Server that was
  exploited three days after it was revealed during the Tianfu Cup^[8]
  hacking contest on October 16-17, 2021.
• CVE-2022-26134^[9] (CVSS score: 9.8) – An
  Object-Graph Navigation Language (OGNL) injection flaw in Atlassian
  Confluence that’s likely to have been leveraged against an unnamed
  U.S. entity days before the flaw’s disclosure on June 2.

The findings also come almost a month after CISA released a list
of top vulnerabilities^[10] weaponized by
China-based actors since 2020 to steal intellectual property and
develop access into sensitive networks.

“Zero-day vulnerabilities are a particularly effective means for
initial exploitation and, once publicly exposed, vulnerabilities
can be rapidly reused by other nation state and criminal actors,”
the company said.