APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-33617 | Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because… | 5.3 | 2% | PoC | |
| CVE-2021-44077 | Unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus | 9.8 | 93% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | manageengine.com | and continuing through Nov. 9. The actors accessed archives.manageengine[.]com and download.manageengine[.]com . Browsing to the first s |
| domain | passwordmanagerpromsp.com | to note that on Nov. 9, we observed the actor connecting to passwordmanagerpromsp[.]com . This domain is associated with another ManageEngine pro |
| sha256 | 67ee552d7c1d46885b91628c603f24b66a9755858e098748f7e7862a71baa015 | tomcat/tomcat-postgres.jar The tomcat-postgres.jar (SHA256: 67ee552d7c1d46885b91628c603f24b66a9755858e098748f7e7862a71baa015 ) file is a variant of the Godzilla webshell that leverages |
| sha256 | ecd8c9967b0127a12d6db61964a82970ee5d38f82618d5db4d8eddbb3b5726b7 | pted to run a malicious dropper called msiexec.exe (SHA256: ecd8c9967b0127a12d6db61964a82970ee5d38f82618d5db4d8eddbb3b5726b7 ). This file was uploaded to the server via the ServiceDesk |
From the original article
12 min read at unit42.paloaltonetworks.com
Over the course of three months, a persistent and determined APT actor has launched multiple campaigns which have now resulted in compromises to at least 4 additional organizations, for a total of 13. Beginning on Sept. 16, 2021, the U.
By Peter Renals · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.