IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Researchers warn of increase in attacks against Zoho software

It's believed as much as 62% of ServiceDesk Plus instances globally are using vulnerable software versions

Security researchers have observed a significant increase in the number of attacks against Zoho software, with a number of instances and organisations already affected across the world.

A total of 13 organisations across industries including defence, energy, technology supply chain, healthcare, and education have been compromised over a three-month period, according to Palo Alto Networks' Unit 42.

Successful exploitation of the software flaws can lead to remote code execution (RCE) and supply attacks using administrator privileges.

Attacks began back in September when CISA warned of cyber criminals exploiting a newly identified, critical-rated vulnerability, tracked as CVE-2021-40539, in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution product from Zoho.

Zoho issued a patch for the exploit in September, followed by an advisory on 22 November explaining the severity of the issue to customers and urging them to patch their systems.

However, researchers at Unit 42 drew attention to a second campaign targeting a different Zoho product in November. The exploit tracked as CVE-2021-44077 which affects ManageEngine ServiceDesk Plus, a help desk and asset management product, was more sophisticated and difficult to detect, researchers noted.

Unit 42 researchers determined that 47% of ADSelfService Plus and 62% of ServiceDesk Plus instances across the globe are still using vulnerable versions and have yet to be patched by customers.

The most recent findings from the past two weeks have confirmed an additional four businesses compromised using the vulnerabilities, two in ADSelfService Plus and two in ServiceDesk Plus, bringing the total to 13 after an initial nine cases were confirmed.

Researchers said they hadn't identified any publicly available proof of concept code for the exploit but observed that the group behind the attacks was indeed using one of their own exploits to compromise unpatched versions of the software.

The group used a variety of initial access vectors to breach Zoho's infrastructure, allowing them to drop a Godzilla webshell using RCE to provide the group with additional access and persistence in compromised systems.

Zoho product attack timeline

Zoho product attack timeline

Palo Alto Networks Unit 42

Two requests were sent to the REST API allowing the attackers to upload the msiexec.exe executable and launch the malicious payload.

Related Resource

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Whitepaper front coverDownload now

Godzilla was used in attacks on both ADSelfService Plus and ServiceDesk Plus, but used different files. A Java Server Pages (JSP) file was used with ADSelfService Plus but Godzilla was dropped using an Apache Tomcat Java Servlet Filter with ServiceDesk Plus.

Using a filter allowed attackers to sift inbound and outbound requests to determine which were meant for the webshell. Installing Godzilla as a webshell also meant that there was no specific URL used by the group to send its requests to the webshell, and it could also bypass a ServiceDesk Plus security filter designed to stop webshells.

Unit 42 researchers said "the best defence against this evolving campaign is a security posture that favours prevention". Businesses are advised to patch all instances and assess the business need for all internet-facing Zoho products.

Zoho customers are also advised to review all files that have been created in the affected products since October 2021 and get in touch with Unit 42 if they think they are affected.

IT Pro has contacted Zoho for comment on the research.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

What is zero trust?
network security

What is zero trust?

14 Jul 2022
Retbleed hardware-level flaw brings overhead woe to Intel and AMD
Hardware

Retbleed hardware-level flaw brings overhead woe to Intel and AMD

13 Jul 2022
An analysis of the European cyber threat landscape
Whitepaper

An analysis of the European cyber threat landscape

8 Jul 2022
Solve cyber resilience challenges with storage solutions
Whitepaper

Solve cyber resilience challenges with storage solutions

4 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022