BruCERT - Alerts & Advisories

Security News

  • Cyberthreats to financial organizations in 2022

    5 days 1 hour ago
    We are going to analyze the forecasts we made at the end of 2020, go through the key events of 2021 relating to financial attacks and make some forecasts about them in 2022.
    Dmitry Bestuzhev, Santiago Pontiroli, Fabio Assolini, Seongsu Park
  • Updated: APT Exploitation of ManageEngine ADSelfService Plus Vulnerability

    1 week 1 day ago
    Original release date: November 19, 2021 | Last revised: November 24, 2021

    The Federal Bureau of Investigation (FBI), CISA, and Coast Guard Cyber Command (CGCYBER) have updated the Joint Cybersecurity Advisory (CSA) published on September 16, 2021, which details the active exploitation of an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus—a self-service password management and single sign-on solution.

    The update provides details on a suite of tools APT actors are using to enable this campaign: 

    • Dropper: a dropper trojan that drops Godzilla webshell on a system 
    • Godzilla: a Chinese language web shell 
    • NGLite: a backdoor trojan written in Go 
    • KdcSponge: a tool that targets undocumented APIs in Microsoft’s implementation of Kerberos for credential exfiltration  

    Note: FBI, CISA, and CGCYBER cannot confirm the CVE-2021-40539 is the only vulnerability APT actors are leveraging as part of this activity, so it is key that network defenders focus on detecting the tools listed above in addition to initial access vector.

    CISA encourages organizations to review the November 19 update and apply the recommended mitigations. CISA also recommends reviewing the relevant blog posts from Palo Alto Networks, Microsoft, and IBM Security Intelligence

    This product is provided subject to this Notification and this Privacy & Use policy.

    CISA