Targeted Attack Campaign Against Manage Engine ADSelf Service Plus Delivers Godzilla Webshells, NGLite Trojan and Kdc Sponge Stealer
Summary: Starting Sept. 17, 2021, an actor used leased U.S. infrastructure to scan at least 370 Zoho ManageEngine ADSelfService Plus servers, then began exploiting CVE-2021-40539, a REST API authentication bypass allowing remote code execution, on Sept. 22. The campaign compromised at least nine entities across technology, defense, healthcare, energy and education, deploying a Godzilla webshell, a customized NGLite backdoor using NKN for command and control, and KdcSponge, which injects into LSASS on domain controllers to harvest Kerberos credentials.
Bottom line: Once the actor reached a domain controller, KdcSponge hooked authentication functions to capture usernames and passwords from any account authenticating via Kerberos, so a single unpatched self-service password portal became a path to domain-wide credential theft.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026