The United States Federal Bureau of Investigations (FBI) released a report detailing attacks on a newly discovered zero-day in the Zoho ManageEngine Desktop Central application. The vulnerability, identified as CVE-2021-44515, allows arbitrary code execution on the targeted machine and was patched in early December. The vulnerability is based on an authentication bypass which allows uploading malicious code to the server. According to Shodan, there are over 3,000 Zoho ManageEngine servers exposed to the internet that could be vulnerable to this attack. Despite the flaw being patched, a Chinese-linked APT27 hacking group was detected attacking vulnerable Zoho servers since at least October 25th. After the attacks were discovered, Zoho released an exploit detection tool that checks for known indicators of compromise for the Zoho ManageEngine instance. For users of Zoho ManageEngine, the company recommends running this tool to ensure no breach has occurred and, if it detects a breach, reset all passwords for service accounts, active directory, and any other service on the affected machine.