APT Expands Attack on Manage Engine With Active Campaign Against Service Desk Plus
Summary: Unit 42 reports that an APT actor it tracks as TiltedTemple expanded from ManageEngine ADSelfService Plus to ManageEngine ServiceDesk Plus, compromising at least 4 more organizations for a total of 13 across technology, energy, healthcare, education, finance and defense. Between Oct. 25 and Nov. 8 the actor exploited CVE-2021-44077, an unauthenticated RCE in ServiceDesk Plus versions 11305 and below disclosed by Zoho on Nov. 22, uploading an msiexec.exe dropper that installs a Godzilla webshell as an Apache Tomcat servlet filter.
Key Takeaway: Xpanse found over 4,700 internet-facing ServiceDesk Plus instances globally, and 2,900 of them - 62% - are assessed as vulnerable, while the actor has also conducted reconnaissance against infrastructure tied to five U.S. states.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2021-44077
- Related
- CVE-2021-44077: Zoho Manage Engine Service Desk Plus Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 01, 2021University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026