NCSC-TAD-2111-002
Severity Level: Critical
Vulnerability
Reference No.: NCSC-TAD-2111-002CVSS 0
Attackers Exploiting Zoho ManageEngine
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- CVE-2021-40539
Overview
APT actors are exploiting an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus. The advisory describes a second campaign exploiting the same vulnerability to deploy the Godzilla webshell, NGLite backdoor, a dropper, and the KdcSponge credential-stealer. These tools allow attackers to maintain persistent network access and gather credentials from the Active Directory server.
Affected Technologies
- Zoho ManageEngine ADSelfService Plus builds 6113 and below.
Mitigation and Immediate Actions
- 01
Update ADSelfService Plus version to the latest version.
- 02
Make sure that ADSelfService Plus is not directly accessible from the internet.
- 03
As mentioned by the company, even those versions that are not yet affected must have the latest version installed.
References
- Robert Falcone, J. W. (2021, November 7). Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer. Retrieved from Palo Alto Networks(opens in a new tab)
- Vaas, L. (2021, November 8). Zoho Password Manager Flaw Torched by Godzilla Webshell. Retrieved from Threat Post(opens in a new tab)