Several Zoho ManageEngine products have been exploited

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

Multiple vulnerabilities have been discovered in Zoho ManageEngine products. The affected products include Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine SupportCenter Plus, Zoho ManageEngine Desktop Central, Zoho ManageEngine AssetExplorer.
CVE 2021 44077 is a vulnerability that could allow an attacker to run arbitrary code. It was discovered on November 20, 2021. This vulnerability, however, may be easily fixed by updating to Zoho version 11306, which was released in September. Attackers are focusing on the healthcare, financial services, electronics, and IT consulting businesses by exploiting this vulnerability.
CVE 2021 44515 & CVE 2021 44526 are authentication bypass vulnerabilities. CVE 2021 44515 only affects Zoho ManageEngine ServiceDesk and Zoho ManageEngine AssetExplorer who uses Desktop Central Agent for asset discovery and CVE 2021 44526 affects all vulnerable versions of Zoho ManageEngine ServiceDesk and Zoho ManageEngine AssetExplorer.
Two of these vulnerabilities (CVE 2021 44077 and CVE 2021 44515) have been exploited in the wild so organizations should upgrade their Zoho ManageEngine products to their latest versions to eliminate these vulnerabilities.
The Techniques used by an unknown actor to exploit CVE 2021 44077 includes:
T1190 – Exploit Public Facing Application
T1505.003 – Server Software Component: Web Shell
T1027 – Obfuscated Files or Information
T1140 – Deobfuscate/Decode Files or Information
T1003 – OS Credential Dumping
T1218 – Signed Binary Proxy Execution
T1136 – Create Account
T1003.003 – OS Credential Dumping: NTDS
T1047 – Windows Management Instrumentation
T1070.004 – Indicator Removal on Host: File Deletion
T1087.002 – Account Discovery: Domain Account
T1560.001 – Archive Collected Data: Archive via Utility
T1573.001 – Encrypted Channel: Symmetric Cryptography