Sophos Firewall Zero-Day Flaw Exploited by Hackers

Chinese hackers leveraged a zero-day exploit for a vital vulnerability in Sophos Firewall to infiltrate a corporation and gain access to the victim’s cloud-hosted web servers. Although the security flaw has been patched, many threat actors have continued to use it to escape authentication and execute arbitrary code remotely on businesses. 

Sophos Firewall’s User Portal and Webadmin parts were found to have an authentication bypass vulnerability, which was tagged as CVE-2022-1040 on March 25. 

Researchers from Volexity revealed that Chinese threat actors used the zero-day vulnerability in Sophos Firewall (CVE-2022-1040) to hack a corporation and its cloud-hosted web servers. The threat actor was still operational when Volexity started the study, and the researchers were able to track the attacker’s movements, showing a clever adversary who tried to go undiscovered.

According to the researchers, “the attacker was using access to the firewall to conduct man-in-the-middle (MitM) assaults.” “Data obtained from these MitM assaults was used by the attacker to target further systems outside of the network where the firewall was located.” Following

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.