Advanced Persistent Threat (APT) actors have exploited known vulnerabilities in Zoho ManageEngine and Fortinet VPN products to hack an organization in the aeronautical sector, according to a joint report from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Cyber Command’s Cyber National Mission Force (CNMF). Impacting more than 20 on-premises Zoho ManageEngine products, the first bug, tracked as CVE-2022-47966 (CVSS score of 9.8), allows remote attackers to execute arbitrary code on affected systems.
The critical severity issue was patched in November 2022. Still, the first signs of exploitation were observed in January 2023, shortly before a Proof-of-Concept (PoC) exploit targeting the flaw was published. At the time, security firms identified thousands of exposed ManagedEngine instances. The second vulnerability, CVE-2022-42475 (CVSS score of 9.8), impacted multiple FortiOS SSL-VPN and FortiProxy SSL-VPN versions and was addressed with emergency patches in December 2022.[1]
In January 2023, Mandiant warned that Chinese hackers had exploited the vulnerability as a zero-day before the patches were released in attacks aimed at a European government organization and a managed service provider in Africa. After investigating between February and April 2023, CISA, FBI, and CNMF discovered that multiple APTs exploited the two flaws starting in January this year to establish persistence on an aeronautical organization’s network.
CISA and co-sealers assess that beginning as early as January 2023, multiple nation-state APT actors were present on the organization’s network via at least two initial access vectors the three agencies note in an advisory (PDF) https://www.cisa.gov/sites/default/files/2023-09/aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475_0.pdf
By exploiting CVE-2022-47966, the attackers gained root-level access to the web server hosting Zoho ManageEngine ServiceDesk Plus, created a local user account with administrative privileges, performed reconnaissance, deployed malware, harvested credentials, and moved laterally into the network.
CISA could not determine if proprietary information was accessed, altered, or exfiltrated. This was due to the organization not clearly defining where their data was centrally located and CISA having limited network sensor coverage, the advisory reads. Another APT, the advisory reveals, exploited CVE-2022-42475 to compromise the organization’s firewall device and establish multiple VPN connections during the first half of February 2023. The attackers disabled admin credentials and deleted logs, preventing the detection of follow-up activities.
It was identified that APT actors compromised and used disabled, legitimate administrative account credentials from a previously hired contractor, of which the organization confirmed the user had been disabled before the observed activity, the advisory explains. The attackers established multiple TLS-encrypted sessions to transfer data from the compromised firewall and moved laterally to a web server, where they deployed web shells.
The investigation revealed that the threat actors used multiple readily available tools during their attacks, including Mimikatz (credential dumping), Ngrok (creates private connection tunnel), ProcDump (process dumper), Metasploit, anydesk.exe (remote access), and others.
See: https://redskyalliance.org/intel-reports/intelligence-report-weekly-data-and-threats-07-26-2023
In their advisory, CISA, FBI, and CNMF provide information on these tools, a detailed timeline of the observed activity, Indicators of Compromise (IoCs) associated with the attacks, and recommended mitigations to prevent similar attacks.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5993554863383553632
[1] https://www.securityweek.com/us-aeronautical-organization-hacked-via-zoho-fortinet-vulnerabilities/
Comments