Security Experts:

Connect with us

Hi, what are you looking for?



Microsoft Says SolarWinds Serv-U Zero-Day Exploited by Chinese Group

Microsoft said on Tuesday that a recently patched SolarWinds Serv-U zero-day vulnerability has been exploited by a Chinese threat group.

Microsoft said on Tuesday that a recently patched SolarWinds Serv-U zero-day vulnerability has been exploited by a Chinese threat group.

IT management solutions provider SolarWinds over the weekend informed customers that its Serv-U Managed File Transfer and Serv-U Secure FTP products are affected by a remote code execution vulnerability that has been exploited in targeted attacks.

The vulnerability, tracked as CVE-2021-35211, affects Serv-U version 15.2.3 HF1 (hotfix 1) and earlier, and it has been patched with the release of 15.2.3 HF2.

According to Microsoft, the vulnerability has been exploited by a threat actor it tracks as DEV-0322 — DEV stands for “development group” and is assigned by the tech giant to groups for which it is highly confident about their origin or identity.

In this case, Microsoft has determined that the group is based in China and that it has been using commercial VPNs and compromised home routers as part of its infrastructure.

DEV-0322 has been observed targeting US defense industrial base organizations and software firms.

Microsoft said the zero-day vulnerability is related to the SSH protocol implementation in Serv-U.

“If Serv-U’s SSH is exposed to the internet, successful exploitation would give attackers ability to remotely run arbitrary code with privileges, allowing them to perform actions like install and run malicious payloads, or view and change data,” Microsoft explained.

Both Microsoft and SolarWinds have made available indicators of compromise (IOCs) for attacks involving exploitation of CVE-2021-35211.

When it informed customers about the availability of patches, SolarWinds clarified that the attacks exploiting CVE-2021-35211 are not related to the SUNBURST supply chain attack, which has been attributed to Russian threat actors.

However, this is not the first time SolarWinds products have been targeted by hackers linked to China. When the supply chain attack was being investigated, it came to light that a threat group believed to be operating out of China had exploited a vulnerability in SolarWinds’ Orion product as part of a campaign that targeted at least one US government organization.

Related: Everything You Need to Know About the SolarWinds Attack 

Related: ‘Sunspot’ Malware Used to Insert Backdoor Into SolarWinds Product

Related: Kaspersky Connects SolarWinds Attack Code to Known Russian APT Group 

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.