Safety Detectives
$ United States dollar
$ United States dollar€ Euro£ British poundAED UAE dirhamARS Argentine pesoAU$ Australian dollarBGN Bulgarian levR$ Brazilian realCA$ Canadian dollarCHF Swiss francCLP Chilean pesoCN¥ Chinese yuanCOP Colombian pesoCZK Czech korunaDKK Danish kroneEGP Egyptian poundHK$ Hong Kong dollarHUF Hungarian forintIDR Indonesian rupiah₪ Israeli new shekelINR Indian rupee¥ Japanese yen₩ South Korean wonMX$ Mexican pesoMYR Malaysian ringgitNOK Norwegian kroneNZ$ New Zealand dollarPLN Polish złotyRON Romanian leuRUB Russian rubleSAR Saudi riyalSEK Swedish kronaSGD Singapore dollar฿ Thai bahtTRY Turkish liraNT$ New Taiwan dollarUAH Ukrainian hryvnia₫ Vietnamese DongZAR South African rand

Nation-State Actors Breach Fortinet and Zoho, warns CISA

Tyler Cross
Tyler Cross
Tyler Cross Tyler Cross

The Cybersecurity and Infrastructure Agency (CISA) released a report on Sept. 7 revealing that hackers took advantage of major vulnerabilities in the Zoho ManageEngine ServiceDesk Plus systems to move laterally through their network.

The report, which was carried out by CISA from January to April, confirmed the attacks and their methods, as well as provided evidence that the attack may have been carried out as early as January.

“Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network,” it reads.

Researchers concluded that the hackers carried out a variety of operations, including TTPs across multiple threat actors, and a multi-stage plan that saw the hackers obtain control of the victim’s firewall and distribute malware.

“Per the activity conducted, APT actors often scan internet-facing devices for vulnerabilities that can be easily exploited. Firewall, virtual private networks (VPNs), and other edge network infrastructure continue to be of interest to malicious cyber actors,” researchers say.

“When targeted, they can be leveraged to expand targeted network access, serve as malicious infrastructure, or a mixture of both.”

While the report details that the threat actors were state-sponsored, it doesn’t directly state which state it was, nor if any proprietary information was stolen.

Previously, the same threat actors carried out an attack on Fortinet, taking advantage of an extreme vulnerability (CVE-2022-42475) to move across their network.

In both cases, the actors made sure to wipe key logs to obfuscate their movements, as well as remove admin account credentials to maintain full control over the networks. CISA recommends companies use security tokens (2FA), and follow strict security practices to avoid having their credentials stolen.

CISA also provides a list of highly technical, but effective mitigation practices you can read here.

About the Author
Tyler Cross
Tyler Cross
Writer

About the Author

Tyler is a writer at SafetyDetectives with a passion for researching all things tech and cybersecurity. Prior to joining the SafetyDetectives team, he worked with cybersecurity products hands-on for more than five years, including password managers, antiviruses, and VPNs and learned everything about their use cases and function. When he isn't working as a "SafetyDetective", he enjoys studying history, researching investment opportunities, writing novels, and playing Dungeons and Dragons with friends."