CVE-2022-47966

CVE-2022-47966 is a critical vulnerability discovered in Zoho ManageEngine ServiceDesk Plus, a widely used IT management software. The flaw was exploited by malicious actors to gain unauthorized access to the organization's systems and networks. The exploitation started just five days after proof-of-concepts (PoCs) for the exploit were publicly disclosed. The threat actors utilized this vulnerability to deliver and deploy a newer malware threat known as "QuiteRAT," which shares many capabilities with the Lazarus Group's MagicRAT malware but has a significantly smaller file size. This vulnerability had a Kenna risk score of 100 out of 100, indicating its high severity. The Peach Sandstorm Advanced Persistent Threat (APT) group was observed attempting to exploit this vulnerability along with another in Atlassian Confluence (CVE-2022-26134) to infiltrate target environments. In 2022, two exploits of the Zoho ManageEngine flaw (CVE-2022-47966) and one ProxyNotShell (CVE-2022-41080, -41082) sample were seen. Remote exploitation of vulnerable applications was a common attack method used by Peach Sandstorm, targeting known remote code execution (RCE) vulnerabilities in both Zoho ManageEngine and Atlas Confluence to gain initial access. North Korea's Lazarus Group and an unknown group that targeted a U.S. aeronautical organization also abused the Zoho ManageEngine vulnerability (CVE-2022-47966). In some instances, threat actors favored exploiting vulnerabilities over password spraying, specifically targeting RCE bugs in Zoho ManageEngine and Confluence. Protection against these threats, including the Zoho ManageEngine Remote Code Execution (CVE-2022-47966), was provided by Check Point IPS. The advisory noted that nation-state APT groups exploited this vulnerability to gain unauthorized access to the organization’s Zoho ManageEngine ServiceDesk Plus instance, subsequently moving laterally through its network.