Lazarus Group exploited ManageEngine vulnerability to target critical infrastructure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-47966 | Unauthenticated SAML RCE in Zoho ManageEngine On-Premise Products | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
From the original article
3 min read at helpnetsecurity.com
North Korean state-sponsored hackers Lazarus Group have been exploiting a ManageEngine ServiceDesk vulnerability (CVE-2022-47966) to target internet backbone infrastructure and healthcare institutions in Europe and the US. The group leveraged the vulnerability to deploy QuiteRAT, downloaded from an IP address previously associated with the Lazarus hacking group (aka APT38).
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.