ManageEngine Vulnerability exploited in the wild caught by rapid7

Rapid7, a cloud-based risk management and threat detection company, has reported that it has observed an increase in cyber attacks that exploit a recently discovered vulnerability in Zoho ManageEngine. The vulnerability, tracked as CVE-2022-47966, is a security defect that exists in a third-party dependency (Apache xmlsec, also known as XML Security for Java, version 1.4.1) and allows attackers to execute arbitrary code remotely without authentication. The vulnerability was deemed "critical" in terms of severity and was first reported by Zoho in November 2022.

Automated penetration testing firm Horizon3.ai had previously warned that there were at least a thousand vulnerable ManageEngine products exposed to the internet and that they were all susceptible to spray and pray attacks. Horizon3.ai also published a proof-of-concept (PoC) exploit targeting the issue. Rapid7 now reports that it has been responding to incidents of compromise resulting from the active exploitation of the vulnerability. The attacks appear to have started even before Horizon3.ai released its PoC exploit.

Rapid7 has stated that some of the impacted products, including ADSelfService Plus and ServiceDesk Plus, are highly popular among organizations and have been known to be targeted in previous attacks. Other impacted products include Access Manager Plus, Active Directory 360, ADAudit Plus, ADManager Plus, Application Control Plus, Device Control Plus, Endpoint Central, Endpoint Central MSP, PAM 360, Password Manager Pro, Remote Monitoring and Management (RMM), SupportCenter Plus, and Vulnerability Manager Plus.

In light of these findings, Rapid7 advises organizations to update their systems immediately and review unpatched systems for signs of compromise. Exploit code for the vulnerability is publicly available and attacks have already begun. Additionally, threat intelligence firm GreyNoise has also reported seeing attacks exploiting the vulnerability.

Comments

Unleashing Chaos: Craxs Rat Update V5 Introduces Terrifying New Features

The notorious Craxs Rat malware has recently unleashed its latest version, Update V5, introducing a range of new features and enhancements. This update further strengthens the capabilities of Craxs Rat, posing an increased threat to individuals and organizations alike. In this article, we delve into the details of the updated features of Craxs Rat V5, shedding light on its improved functionality and potential impact on cybersecurity.

Prilex: The Most Advanced PoS Malware with the Ability to Block Contactless Payments

Prilex is a highly advanced malware that has evolved from ATM-focused malware into a unique modular PoS malware, known to be the most advanced PoS threat seen so far. It has a unique cryptographic scheme, performs real-time patching in target software, forces protocol downgrades, manipulates cryptograms, performs GHOST transactions and performs credit card fraud. Recently, three new versions of Prilex have been discovered with the ability to block contactless payment transactions, which have become popular due to the pandemic. These new versions block NFC-based transactions and force victims to use their physical card by inserting it into the PIN pad reader, which allows the malware to capture the data coming from the transaction.

BlackLotus UEFI Bootkit: A New Threat to Windows Security

In March 2023, security researchers from ESET announced the discovery of a new UEFI bootkit called BlackLotus . This bootkit is capable of bypassing UEFI Secure Boot, a security feature that is designed to prevent malware from infecting a computer's firmware. Once BlackLotus is installed, it can give an attacker complete control over the computer, including the ability to steal data, install other malware, and disrupt the computer's operation. BlackLotus is a sophisticated piece of malware that is difficult to detect and remove. It is also relatively new, so there is limited information about how it works. However, ESET researchers have been able to learn a lot about BlackLotus, and they have published a detailed analysis of the malware.

#1 All in One Platform for Cyber Security News

Tech News Centre

Search This Blog