---
title: Targeted Attack Campaign Against ManageEngine
description: Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer
---

[News | KiZAN Technologies ](https://www.kizan.com/news)

# [Targeted Attack Campaign Against ManageEngine](https://www.kizan.com/news/active-exploitation-of-microsoft-exchange-on-prem-vulnerabilities-0)

 Written by [Brad Watson](https://www.kizan.com/news/author/brad-watson) | Nov 8, 2021 9:40:06 PM

# Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855>On Sept. 16, 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) released an alert warning that advanced persistent threat (APT) actors were actively exploiting newly identified vulnerabilities in a self-service password management and single sign-on solution known as ManageEngine ADSelfService Plus. The alert explained that malicious actors were observed deploying a specific webshell and other techniques to maintain persistence in victim environments; however, in the days that followed, a second unrelated campaign to carry out successful attacks against the same vulnerability was observed.

[Read More](https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/)

## Contact us if you need any assistance.

 

[View full post](https://www.kizan.com/news/active-exploitation-of-microsoft-exchange-on-prem-vulnerabilities-0)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Brad Watson"
  },
  "dateModified" : "2021-11-08T21:40:06.131Z",
  "datePublished" : "2021-11-08T21:40:06Z",
  "headline" : "Targeted Attack Campaign Against ManageEngine",
  "image" : {
    "@type" : "ImageObject",
    "height" : 675,
    "url" : "https://f.hubspotusercontent40.net/hubfs/2059240/KiZAN%20Security%20Alert-general.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.kizan.com/news/active-exploitation-of-microsoft-exchange-on-prem-vulnerabilities-0",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2059240/KiZAN_logoBlueOrgDot120px.png",
      "width" : 124.137924
    },
    "name" : "News"
  }
}
```