Microsoft said on Tuesday that a recently patched SolarWinds Serv-U zero-day vulnerability has been exploited by a Chinese threat group.
IT management solutions provider SolarWinds over the weekend informed customers that its Serv-U Managed File Transfer and Serv-U Secure FTP products are affected by a remote code execution vulnerability that has been exploited in targeted attacks.
The vulnerability, tracked as CVE-2021-35211, affects Serv-U version 15.2.3 HF1 (hotfix 1) and earlier, and it has been patched with the release of 15.2.3 HF2.
According to Microsoft, the vulnerability has been exploited by a threat actor it tracks as DEV-0322 — DEV stands for “development group” and is assigned by the tech giant to groups for which it is highly confident about their origin or identity.
In this case, Microsoft has determined that the group is based in China and that it has been using commercial VPNs and compromised home routers as part of its infrastructure.
DEV-0322 has been observed targeting US defense industrial base organizations and software firms.
Microsoft said the zero-day vulnerability is related to the SSH protocol implementation in Serv-U.
“If Serv-U’s SSH is exposed to the internet, successful exploitation would give attackers ability to remotely run arbitrary code with privileges, allowing them to perform actions like install and run malicious payloads, or view and change data,” Microsoft explained.
Both Microsoft and SolarWinds have made available indicators of compromise (IOCs) for attacks involving exploitation of CVE-2021-35211.
When it informed customers about the availability of patches, SolarWinds clarified that the attacks exploiting CVE-2021-35211 are not related to the SUNBURST supply chain attack, which has been attributed to Russian threat actors.
However, this is not the first time SolarWinds products have been targeted by hackers linked to China. When the supply chain attack was being investigated, it came to light that a threat group believed to be operating out of China had exploited a vulnerability in SolarWinds’ Orion product as part of a campaign that targeted at least one US government organization.
Related: Everything You Need to Know About the SolarWinds Attack
Related: ‘Sunspot’ Malware Used to Insert Backdoor Into SolarWinds Product
Related: Kaspersky Connects SolarWinds Attack Code to Known Russian APT Group