In a joint advisory published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Cyber Command (USCYBERCOM), multiple unnamed Iranian state-sponsored threat actors have been confirmed to have compromised a U.S. aeronautical organization by exploiting critical vulnerabilities in Zoho ManageEngine and Fortinet firewalls. The flaws were patched in December 2022, so researchers speculate that the threat actors have likely been present in the victim network since January 2023. The first vulnerability, tracked as CVE-2022-47966, is a remote code execution (RCE) flaw affecting multiple Zoho ManageEngine on-premise products and was used to hack an internet-exposed server running Zoho ManageEngine ServiceDesk Plus. Once exploited, the threat actors were able to establish persistence and move laterally across the victim network. The second vulnerability, tracked as CVE-2022-42475, is a heap-based buffer overflow vulnerability in FortiOS SSL-VPN appliances that allows remote unauthenticated attackers to execute arbitrary code or commands via maliciously crafted requests. The threat actors exploited this vulnerability to establish persistence on the victim’s Fortinet firewall device. To prevent exploitation, organizations should ensure that they always keep their software up-to-date by patching all systems for Known Exploited Vulnerabilities (KEVs), including firewall security appliances. They should also ensure their security teams are monitoring the network for unauthorized use of remote access software using endpoint detection tools and remove inactive accounts and groups from the enterprise network that are no longer needed, especially privileged accounts. Unfortunately, stale infrastructure is a leading culprit for enterprise network compromises. This compromise may have been avoided if the victim followed a routine patching cycle and prioritized the remediation of vulnerabilities on internet-facing systems.