By 
State-backed hacking groups have breached a U.S. aeronautical organization using exploits targeting critical Zoho and Fortinet vulnerabilities.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that multiple nation-state actors are exploiting security flaws in Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus to gain unauthorized access and establish persistence on compromised systems.
According to a joint advisory published by CISA, the FBI, and the United States Cyber Command (USCYBERCOM), the threat groups behind this breach are yet to be named.
Although the joint advisory didn't connect the attackers to a specific state, USCYBERCOM's press release links the malicious actors to Iranian exploitation efforts.
CISA was part of the incident response between February and April and said the hacking groups had been in the compromised aviation organization's network since at least January after hacking an Internet-exposed server running Zoho ManageEngine ServiceDesk Plus and a Fortinet firewall.
The APT hackers exploited CVE-2022-47966 to gain unauthorized access to Zoho ManageEngine ServiceDesk Plus, establish persistence, and move laterally through the network.
This vulnerability allows for remote code execution on the ManageEngine application. Additional APT actors were also observed exploiting CVE-2022-42475 to establish presence on the organization's firewall device.
As the three U.S. agencies warn, these threat groups frequently scan for vulnerabilities on Internet-facing devices unpatched against critical and easy-to-exploit security bugs.
After infiltrating a target's network, the attackers will maintain persistence on hacked network infrastructure components. These network devices are used as stepping stones for lateral movement within the victims' networks, as malicious infrastructure, or a combination of both.
Network defenders are advised to apply mitigations and NSA-recommended best practices for securing infrastructure. All systems are required to be secured against all known exploited vulnerabilities, monitoring for unauthorized use of remote access software, and removing unnecessary (disabled) accounts and groups.
