Loading story…
Microsoft attributed a targeted campaign exploiting CVE-2021-40539 in Zoho ManageEngine ADSelfService Plus to the China-based threat group DEV-0322 with high confidence. First observed on September 22, 2021, the campaign targeted organizations apparently operating in the defense industrial base, higher education, consulting, and information technology sectors. Following exploitation, attackers dumped credentials, moved laterally, and installed a custom IIS backdoor capable of executing commands, transferring files, and capturing authentication credentials.
DEV-0322 also deployed Zebracon, a Trojan that retrieves commands through an attacker-controlled mailbox hosted on suspected compromised Zimbra email servers. Microsoft published malware detections, hunting queries, and file-hash indicators to support investigations. Organizations running ADSelfService Plus should verify remediation of CVE-2021-40539 and investigate exposed installations for credential theft, lateral movement, and persistent backdoors; patching alone does not remove an existing compromise.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft first observed a campaign exploiting CVE-2021-40539 in vulnerable ZOHO ManageEngine ADSelfService Plus installations. Targets appeared to operate in the Defense Industrial Base, higher education, consulting services, and information technology sectors.
On September 9, 2021, the Canadian Centre for Cyber Security issued alert AV21-445 urging administrators to review Zoho’s September 7 advisory and apply updates. The advisory concerned a REST API authentication-bypass vulnerability affecting ADSelfService Plus build 6113 and earlier, for which Zoho reported an exploit existed in the wild.
ManageEngine announced a security-fix release for ADSelfService Plus build 6114. The supplied reference does not identify the vulnerabilities addressed.
Microsoft attributed the campaign with high confidence to China-based DEV-0322 based on infrastructure, victimology, tactics, and procedures. It published technical findings, malware indicators, and hunting queries, and made campaign indicators available through the Microsoft Sentinel Emerging Threat Feed.
DEV-0322 also deployed the Zebracon Trojan, which used hardcoded credentials to connect to Zimbra email servers suspected of having been compromised by the group. It received commands through messages in an actor-controlled mailbox.
Following exploitation, DEV-0322 dumped credentials and moved laterally to other systems, where it installed a malicious IIS module. The module supported command execution and file transfers and captured incoming authentication credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcepitstop.manageengine.com
Open sourcemicrosoft.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that a China-linked threat actor tracked as **DEV-0322** exploited **CVE-2021-40539** in vulnerable **Zoho ManageEngine ADSelfService Plus** servers to compromise organizations in the defense industrial base, higher education, consulting, and information technology sectors. The intrusions involved credential dumping, lateral movement, and the installation of a malicious **IIS** module that accepted commands through HTTP cookies, harvested authentication data into `key.dat`, and could deploy `ccc.exe` to run `cmd.exe` commands on infected systems. Additional reporting tied the activity to a broader post-exploitation toolset associated with **Godzilla**, **NGLite**, and **KdcSponge**, reinforcing that the attackers were focused on stealthy persistence and credential access after initial compromise. Microsoft also said the actor deployed **Trojan:Win64/Zebracon**, which used hardcoded credentials to access compromised **Zimbra** mail servers and retrieve commands through **SOAP** email operations, and published detections, hunting queries, and indicators of compromise to help defenders identify affected systems and follow-on activity.
Aug 15, 2026
Attackers exploited **CVE-2019-8394** in Zoho ManageEngine ServiceDesk Plus to upload web shells and compromise networks despite a patch released in early 2019, according to SOC Prime’s December 2020 report. The vulnerability affects versions before **10.0 build 10012** and involves insufficient sanitization of user-supplied input in crafted SMTP requests. Exploitation requires authentication but can be performed with minimal privileges, including guest credentials, enabling arbitrary system command execution. Web shells can give attackers persistent access to affected servers and support further network compromise. Organizations running vulnerable builds should upgrade to a patched version and investigate exposed systems for unauthorized web shells; patching alone does not remove an existing compromise. SOC Prime also pointed defenders to NSA and Australian Signals Directorate guidance on detecting and preventing web shell malware, providing complementary measures for identifying malicious server-side files and reducing opportunities for persistent access.
Oct 9, 2026
Active in-the-wild exploitation of **SolarWinds Web Help Desk (WHD)** vulnerabilities is being used to achieve **remote code execution (RCE)** on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via `wrapper.exe` spawning `java.exe` in the Tomcat-based application), where attackers executed `cmd.exe` to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (`esmahyft@proton[.]me`). The activity is linked to recently disclosed WHD issues, including **CVE-2025-40551** (untrusted deserialization leading to code execution, added to **CISA KEV**) and **CVE-2025-26399**, which multiple vendors have cited as being exploited in the wild. Post-compromise, the actor used the Zoho RMM process (`TOOLSIQ.EXE`) as an operational foothold to run **Active Directory discovery** and domain enumeration (e.g., `net group "domain computers" /do`) consistent with preparation for lateral movement. The intrusions also included deployment of **Velociraptor** for endpoint control and collection, and use of **Cloudflare tunnels** to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Jun 29, 2026