Connect with us

Hi, what are you looking for?



Microsoft Says SolarWinds Serv-U Zero-Day Exploited by Chinese Group

Microsoft said on Tuesday that a recently patched SolarWinds Serv-U zero-day vulnerability has been exploited by a Chinese threat group.

Microsoft said on Tuesday that a recently patched SolarWinds Serv-U zero-day vulnerability has been exploited by a Chinese threat group.

IT management solutions provider SolarWinds over the weekend informed customers that its Serv-U Managed File Transfer and Serv-U Secure FTP products are affected by a remote code execution vulnerability that has been exploited in targeted attacks.

The vulnerability, tracked as CVE-2021-35211, affects Serv-U version 15.2.3 HF1 (hotfix 1) and earlier, and it has been patched with the release of 15.2.3 HF2.

According to Microsoft, the vulnerability has been exploited by a threat actor it tracks as DEV-0322 — DEV stands for “development group” and is assigned by the tech giant to groups for which it is highly confident about their origin or identity.

In this case, Microsoft has determined that the group is based in China and that it has been using commercial VPNs and compromised home routers as part of its infrastructure.

DEV-0322 has been observed targeting US defense industrial base organizations and software firms.

Microsoft said the zero-day vulnerability is related to the SSH protocol implementation in Serv-U.

“If Serv-U’s SSH is exposed to the internet, successful exploitation would give attackers ability to remotely run arbitrary code with privileges, allowing them to perform actions like install and run malicious payloads, or view and change data,” Microsoft explained.

Advertisement. Scroll to continue reading.

Both Microsoft and SolarWinds have made available indicators of compromise (IOCs) for attacks involving exploitation of CVE-2021-35211.

When it informed customers about the availability of patches, SolarWinds clarified that the attacks exploiting CVE-2021-35211 are not related to the SUNBURST supply chain attack, which has been attributed to Russian threat actors.

However, this is not the first time SolarWinds products have been targeted by hackers linked to China. When the supply chain attack was being investigated, it came to light that a threat group believed to be operating out of China had exploited a vulnerability in SolarWinds’ Orion product as part of a campaign that targeted at least one US government organization.

Related: Everything You Need to Know About the SolarWinds Attack 

Related: ‘Sunspot’ Malware Used to Insert Backdoor Into SolarWinds Product

Related: Kaspersky Connects SolarWinds Attack Code to Known Russian APT Group 

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...