IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Researchers warn of increase in attacks against Zoho software

It's believed as much as 62% of ServiceDesk Plus instances globally are using vulnerable software versions

Security researchers have observed a significant increase in the number of attacks against Zoho software, with a number of instances and organisations already affected across the world.

A total of 13 organisations across industries including defence, energy, technology supply chain, healthcare, and education have been compromised over a three-month period, according to Palo Alto Networks' Unit 42.

Successful exploitation of the software flaws can lead to remote code execution (RCE) and supply attacks using administrator privileges.

Attacks began back in September when CISA warned of cyber criminals exploiting a newly identified, critical-rated vulnerability, tracked as CVE-2021-40539, in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution product from Zoho.

Zoho issued a patch for the exploit in September, followed by an advisory on 22 November explaining the severity of the issue to customers and urging them to patch their systems.

However, researchers at Unit 42 drew attention to a second campaign targeting a different Zoho product in November. The exploit tracked as CVE-2021-44077 which affects ManageEngine ServiceDesk Plus, a help desk and asset management product, was more sophisticated and difficult to detect, researchers noted.

Unit 42 researchers determined that 47% of ADSelfService Plus and 62% of ServiceDesk Plus instances across the globe are still using vulnerable versions and have yet to be patched by customers.

The most recent findings from the past two weeks have confirmed an additional four businesses compromised using the vulnerabilities, two in ADSelfService Plus and two in ServiceDesk Plus, bringing the total to 13 after an initial nine cases were confirmed.

Researchers said they hadn't identified any publicly available proof of concept code for the exploit but observed that the group behind the attacks was indeed using one of their own exploits to compromise unpatched versions of the software.

The group used a variety of initial access vectors to breach Zoho's infrastructure, allowing them to drop a Godzilla webshell using RCE to provide the group with additional access and persistence in compromised systems.

Zoho product attack timeline

Zoho product attack timeline

Palo Alto Networks Unit 42

Two requests were sent to the REST API allowing the attackers to upload the msiexec.exe executable and launch the malicious payload.

Related Resource

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Whitepaper front coverDownload now

Godzilla was used in attacks on both ADSelfService Plus and ServiceDesk Plus, but used different files. A Java Server Pages (JSP) file was used with ADSelfService Plus but Godzilla was dropped using an Apache Tomcat Java Servlet Filter with ServiceDesk Plus.

Using a filter allowed attackers to sift inbound and outbound requests to determine which were meant for the webshell. Installing Godzilla as a webshell also meant that there was no specific URL used by the group to send its requests to the webshell, and it could also bypass a ServiceDesk Plus security filter designed to stop webshells.

Unit 42 researchers said "the best defence against this evolving campaign is a security posture that favours prevention". Businesses are advised to patch all instances and assess the business need for all internet-facing Zoho products.

Zoho customers are also advised to review all files that have been created in the affected products since October 2021 and get in touch with Unit 42 if they think they are affected.

IT Pro has contacted Zoho for comment on the research.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide
Whitepaper

CIAM buyer’s guide

6 Jun 2022

Most Popular

Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022