CISA, FBI, and CNMF Release Advisory on Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

Summary:

On [_TILE_OPEN_CASE_TITLE], the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and U.S. Cyber Command’s Cyber National Mission Force (CNMF) jointly published a cybersecurity advisory (CSA) alerting organizations to a serious threat posed by nation-state advanced persistent threat (APT) actors exploiting two critical vulnerabilities, CVE-2022-47966 and CVE-2022-42475.

Incident Overview:

The advisory reports on a documented incident at an Aeronautical Sector organization, where malicious activity was observed as early as January 2023. The APT actors exploited CVE-2022-47966, a remote code execution vulnerability in Zoho ManageEngine ServiceDesk Plus, a public-facing application. This allowed them to gain unauthorized access to the application, establish persistence, and move laterally through the network.

Additionally, other APT actors were observed exploiting CVE-2022-42475, a vulnerability that enables presence on the organization’s firewall device.

Mitigation Efforts:

The authoring agencies urge organizations to swiftly review the advisory and implement the recommended mitigations, which align with CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) and National Institute of Standards and Technology (NIST) best practices, as well as NSA-recommended best practices for securing infrastructure.

Reporting Suspicious Activity:

Organizations are advised to report any suspicious or criminal activity related to the information in the joint Cybersecurity Advisory to their local FBI field office or CISA’s 24/7 Operations Center at report@cisa.gov or (888) 282-0870.

In summary, this joint advisory serves as a critical alert to organizations to take immediate action to address these exploited vulnerabilities and prevent further exploitation by nation-state APT actors.