A critical vulnerability in the Zoho single sign-on and password management solution has recently been exploited by likely state-sponsored Advanced Persistent Threat (APT) groups according to the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Coast Guard Cyber Command (CGCYBER). The vulnerability tracked as CVE-2021-40539 exists within Zoho’s ManageEngine ADSelfService Plus password management solution, used by three out of five Fortune 500 companies, and when exploited the flaw can allow for an unauthenticated attacker to execute arbitrary code remotely on vulnerable systems. The above-mentioned agencies have published a joint advisory stating, “Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.” Zoho has since released an update (ADSelfService Plus build 6114) that patches the vulnerability, and users are urged to update immediately due to this vulnerability being exploited in the wild. Attacks have also targeted critical infrastructure, and the Ankura CTAPT will provide updates on the actors, as well as anymore fallout from these exploits.