The Federal Bureau of Investigation (FBI) has released an alert regarding the exploitation of a recent vulnerability in Zoho’s ManageEngine Desktop Central product.
Tracked as CVE-2021-44515, the security error is an authentication bypass that can be exploited to achieve remote code execution. The bug affects the Professional and Enterprise editions of ServiceDesk Plus and potentially impacts tens of thousands of organizations around the world.
Rated critical (CVSS score of 9.8), the vulnerability was made public in early December, when Zoho warned that threat actors had already been exploiting the bug in attacks.
Now, the FBI says that exploitation by advanced persistent threat (APT) actors has been ongoing since at least October 2021. The attackers have been dropping a webshell on compromised Desktop Central servers, to override a legitimate function and set up for post-compromise activities.
The adversaries used the webshells to drop further tools, enumerate domain users, perform reconnaissance, and attempt to move laterally in the network and steal credentials.
READ: U.S. Agencies Share More Details on ADSelfService Plus Vulnerability Exploitation
Two variants of the observed webshells were used in these attacks, both designed to override a Desktop Central API servlet endpoint and gain access to inbound GET or outbound POST requests and execute commands with System privileges.
Following initial reconnaissance, the attackers deployed a ShadowPad variant dropper and a legitimate binary that is then abused to achieve persistence. When executed, the dropper injects backdoor code into an instance of svchost, to connect to a command and control (C&C) server and enable further malicious activities.
Organizations are encouraged to upgrade their ManageEngine Desktop Central installations as soon as possible, to ensure they can prevent potential attacks. Those running version 10.1.2127.17 and below should upgrade to 10.1.2127.18, while builds 10.1.2128.0 to 10.1.2137.2 should be upgraded to 10.1.2137.3.
Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging organizations to apply the available patches as soon as possible.
Related: Zoho Confirms New Zero-Day, Ships Exploit Detector
Related: Zoho Confirms Zero-Day Authentication Bypass Attacks
Related: U.S. Agencies Warn of APTs Exploiting Zoho Zero-Day

More from Ionut Arghire
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- GitLab Security Update Patches Critical Vulnerability
- Android App With 50,000 Downloads in Google Play Turned Into Spyware via Update
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
