# APT actors exploit Zoho ManageEngine ServiceDesk RCE

Published: 2025-07-14 · Severity: high · Sectors: healthcare, financial-services, technology, defense
Canonical: https://vorant.io/reports/a8f62e69-9260-5767-b384-d31c6843770c/apt-actors-exploit-zoho-manageengine-servicedesk-rce

> APT groups are actively exploiting CVE-2021-44077, an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus, to deploy webshells and steal credentials.

CVE-2021-44077 is a critical unauthenticated remote code execution vulnerability in Zoho ManageEngine ServiceDesk Plus affecting all versions up to 11305. The vulnerability allows attackers to upload executable files and webshells via the ServiceDesk REST API, enabling post-exploitation activities including credential theft, lateral movement, and data exfiltration. Zoho released patches on September 16, 2021 (build 11306+), with a subsequent advisory on November 22, 2021 urging immediate patching.

The FBI and CISA assess that advanced persistent threat actors have been actively exploiting this vulnerability since at least late October 2021. Attackers use the initial access to deploy webshells and multiple implants including Godzilla JAR backdoors, NGLite, KDC Sponge, and custom malware. Post-exploitation activity follows a consistent pattern: dumping NTDS.dit and registry hives, harvesting credentials via LSASS, conducting lateral movement with WMI, and exfiltrating data through webshells. Attackers deliberately clean up logs and artifacts to obscure evidence of initial compromise.

Targeted sectors include healthcare, financial services, electronics, and IT consulting. The threat actors demonstrate operational security practices including use of signed Windows binaries, custom symmetric encryption for command and control, and renamed legitimate tools like WinRAR and csvde for reconnaissance and exfiltration.

## Mentioned in this report

- Vulnerabilities: CVE-2021-44077 (KEV)
- Malware: GODZILLA, KDC Sponge, NGLite

## Detection guidance (public sample)

### ManageEngine ServiceDesk Java Process Spawning Shell or Recon Tools

ATT&CK: T1190

Detects the ServiceDesk Plus Java service spawning command interpreters or recon/credential utilities, consistent with CVE-2021-44077 exploitation and webshell or implant execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ManageEngine ServiceDesk Java Process Spawning Shell or Recon Tools
description: Detects the ManageEngine ServiceDesk Plus Java service spawning command
  shells, WMI, or recon and credential tools. Matches the post-exploitation pattern
  after CVE-2021-44077 webshell upload, not specific implant names.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- attack.execution
- attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - ServiceDesk
    - ManageEngine
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wmic.exe
    - \ntdsutil.exe
    - \csvde.exe
    - \reg.exe
    - \rundll32.exe
    - \certutil.exe
    - \net.exe
    - \net1.exe
  condition: selection_parent and selection_child
falsepositives:
- ServiceDesk administrators running custom scripts or batch integrations through
  the application
- Legitimate ServiceDesk upgrade or service-restart scripts invoking cmd.exe
level: high
id: ae9dd320-0a14-5519-a339-f83ac09ddf46
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
```

### NTDS.dit or Registry Hive Dumping via Command Line

ATT&CK: T1003.003

Detects ntdsutil IFM/snapshot creation or reg save of SAM/SYSTEM/SECURITY hives for credential theft, as seen in post-exploitation of ServiceDesk compromises. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: NTDS.dit or Registry Hive Dumping via Command Line
description: Detects ntdsutil creating IFM or snapshot media, or reg.exe saving SAM/SYSTEM/SECURITY
  hives, used to steal domain credentials after initial compromise.
tags:
- attack.credential-access
- attack.t1003.003
- attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection_ntdsutil:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains:
    - ifm
    - create full
    - snapshot
  selection_reg:
    Image|endswith: \reg.exe
    CommandLine|contains:
    - ' save '
    - ' export '
    CommandLine|contains|all:
    - hklm
  selection_hive:
    CommandLine|contains:
    - \sam
    - \system
    - \security
  selection_ntds_copy:
    CommandLine|contains: ntds.dit
  condition: selection_ntdsutil or (selection_reg and selection_hive) or selection_ntds_copy
falsepositives:
- Authorised backup or AD disaster-recovery procedures run by domain admins
- Security assessment tooling during sanctioned penetration tests
level: high
id: 53065047-76e4-5bcb-b05e-77a48b254def
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
```

### WMI Remote Process Creation for Lateral Movement

ATT&CK: T1047

Detects wmic.exe launching processes on remote nodes, used for lateral movement in the ServiceDesk post-exploitation chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WMI Remote Process Creation for Lateral Movement
description: Detects wmic.exe with /node and process call create, a lateral movement
  pattern used by actors exploiting ManageEngine ServiceDesk.
tags:
- attack.execution
- attack.t1047
- attack.lateral-movement
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - /node
    - process
    - call
    - create
  condition: selection
falsepositives:
- Legacy administrative scripts deploying software to remote hosts via WMIC
- Endpoint management tooling using wmic for remote execution
level: medium
id: df08803c-8cf6-5768-8f31-3712f21a79e7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-336a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a8f62e69-9260-5767-b384-d31c6843770c/apt-actors-exploit-zoho-manageengine-servicedesk-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup