The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert warning of multiple nation-state hacking groups exploiting known vulnerabilities in Zoho ManageEngine software and Fortinet firewalls.
Furthemore, the agency conducted an investigation from February through April at an undisclosed organization in the aeronautical sector and found that beginning in January, several advanced persistent threat (APT) groups separately exploited two critical vulnerabilities to gain unauthorized access and exfiltrate data.
The vulnerabilities in question are CVE-2022-47966 in Zoho ManageEngine and CVE-2022-42475 in Fortinet FortiOS SSL VPN, both of which have been classified as critical.
These flaws allow attackers to remotely execute code, effectively taking control of the system and enabling them to pivot to other parts of the network. Both vendors had issued patches for these vulnerabilities in late 2022, but APT groups continued to exploit them.
The CISA alert, jointly issued with the FBI and U.S. Cyber Command’s Cyber National Mission Force, does not attribute the attacks to specific nations but notes that private sector reporting has previously linked hackers aligned with China, Iran, and North Korea to known exploits of these vulnerabilities.
The ongoing exploitation of these patched vulnerabilities underscores the importance of prompt patching and cybersecurity readiness in the face of persistent nation-state threats.
