Loading story…
Microsoft reported that a China-linked threat actor tracked as DEV-0322 exploited CVE-2021-40539 in vulnerable Zoho ManageEngine ADSelfService Plus servers to compromise organizations in the defense industrial base, higher education, consulting, and information technology sectors. The intrusions involved credential dumping, lateral movement, and the installation of a malicious IIS module that accepted commands through HTTP cookies, harvested authentication data into key.dat, and could deploy ccc.exe to run cmd.exe commands on infected systems.
Additional reporting tied the activity to a broader post-exploitation toolset associated with Godzilla, NGLite, and KdcSponge, reinforcing that the attackers were focused on stealthy persistence and credential access after initial compromise. Microsoft also said the actor deployed Trojan:Win64/Zebracon, which used hardcoded credentials to access compromised Zimbra mail servers and retrieve commands through SOAP email operations, and published detections, hunting queries, and indicators of compromise to help defenders identify affected systems and follow-on activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said it first observed the latest DEV-0322 campaign on September 22, 2021, targeting vulnerable Zoho ManageEngine ADSelfService Plus servers via CVE-2021-40539. The activity targeted organizations in the defense industrial base, higher education, consulting services, and information technology sectors.
Zoho published a security advisory and released an update for the critical ADSelfService Plus flaw CVE-2021-40539 after observing indications of exploitation in the wild. CISA also warned that the authentication bypass bug was being actively exploited and urged organizations running builds lower than 6114 to patch immediately.
Microsoft released detection names, Microsoft 365 Defender alert titles, hunting guidance, and SHA-256 indicators of compromise to help customers identify devices affected by the DEV-0322 campaign. It also stated it had not observed exploitation of Microsoft products in this activity.
Microsoft reported a targeted post-exploitation campaign tied to CVE-2021-40539 and attributed it with high confidence to DEV-0322, which it assessed as a China-based threat group. The company also disclosed technical details including credential dumping, lateral movement, a malicious IIS module, and Zebracon malware used in the intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked espionage group tracked as **Cicada**/**APT10** exploited Microsoft’s **Zerologon** flaw, `CVE-2020-1472`, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of **Active Directory** environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks. The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included **QuasarRAT**, the newly observed **Backdoor.Hartip**, DLL side-loading, and administrative utilities such as **WMIExec**, **Certutil**, and **PowerShell**. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as `CppHostCLR`-based .NET loader execution and **ConfuserEx** obfuscation.
Aug 15, 2026
Active in-the-wild exploitation of **SolarWinds Web Help Desk (WHD)** vulnerabilities is being used to achieve **remote code execution (RCE)** on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via `wrapper.exe` spawning `java.exe` in the Tomcat-based application), where attackers executed `cmd.exe` to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (`esmahyft@proton[.]me`). The activity is linked to recently disclosed WHD issues, including **CVE-2025-40551** (untrusted deserialization leading to code execution, added to **CISA KEV**) and **CVE-2025-26399**, which multiple vendors have cited as being exploited in the wild. Post-compromise, the actor used the Zoho RMM process (`TOOLSIQ.EXE`) as an operational foothold to run **Active Directory discovery** and domain enumeration (e.g., `net group "domain computers" /do`) consistent with preparation for lateral movement. The intrusions also included deployment of **Velociraptor** for endpoint control and collection, and use of **Cloudflare tunnels** to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Jun 29, 2026
Trend Micro disclosed that the China-aligned cluster **SHADOW-EARTH-053** compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the `ProxyLogon` chain, then deploying **GODZILLA** web shells and the **ShadowPad** backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption. Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via `EnumDesktopsA` callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as **IOX**, **GOST**, **Wstunnel**, **Sharp-SMBExec**, **Mimikatz**, and **Evil-CreateDump**. Trend Micro also identified overlap with a related cluster, **SHADOW-EARTH-054**, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
Jun 29, 2026