Security News > 2021 > December > FBI: Another Zoho ManageEngine Zero-Day Under Active Attack
Another Zoho ManageEngine zero-day vulnerability is under active attack from an APT group, this time looking to override legitimate functions of servers running ManageEngine Desktop Central and elevate privileges - with an ultimate goal of dropping malware onto organizations' networks, the FBI has warned.
There is also evidence to support that it's being used in an attack chain with two other Zoho bugs that researchers have observed under attack since September, according to the alert.
The bug is the third zero-day under active attack that researchers have discovered in the cloud platform company's ManageEngine suite since September, spurring dire warnings from the FBI and researchers alike.
Unit 42 researchers combined the two previously known active attack fronts against Zoho's ManageEngine as the "TitledTemple" campaign, and said earlier this month that there is evidence to link the APT responsible to China, although it is not conclusive.
The latest Flash Alert released by the FBI also shows a correlation between earlier APT attacks on ManageEngine and AdSelfService Plus, with malicious samples of code observed in the latest exploitation "Downloaded from likely compromised ManageEngine.ADSelfService Plus servers," according to the alert.
The FBI Flash Alert includes a detailed list of indicators of compromise so organizations using Zoho's ManageEngine Desktop Central can check to see if they are at risk or have been a victim of attack.
News URL
https://threatpost.com/zoho-zero-day-manageengine-active-attack/177178/
Related news
- FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks (source)
- FBI Warns U.S. Healthcare Sector of Targeted BlackCat Ransomware Attacks (source)
- Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks (source)
- Apple fixes two new iOS zero-days exploited in attacks on iPhones (source)
- FBI: Critical infrastructure suffers spike in ransomware attacks (source)
- DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)
- Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack (source)
- Palo Alto Networks warns of PAN-OS firewall zero-day used in attacks (source)
- FBI warns of massive wave of road toll SMS phishing attacks (source)