Lazarus Group exploits Manage Engine vulnerability to deploy QuiteRAT
Summary: Cisco Talos reported that Lazarus Group compromised an internet backbone infrastructure provider in Europe in early 2023 by exploiting a vulnerable ManageEngine ServiceDesk instance (CVE-2022-47966) to download and execute the QuiteRAT implant through the Java runtime process. QuiteRAT, a roughly 4 to 5MB Qt-based remote access trojan assessed as a derivative of MagicRAT, gathers MAC addresses, IP addresses and usernames, hashes them with MD4 as a victim identifier, and relies on the C2 server to issue a registry-based persistence command because it has no built-in persistence.
Why it matters: The vulnerability used here carries a Kenna risk score of 100 out of 100, and the implant's C2 can order it to sleep for a set number of minutes to stay dormant while keeping access to the compromised network.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-47966
- Related
- CVE-2022-47966: Zoho Manage Engine Multiple Products Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 23, 2023University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026