Loading story…
Active in-the-wild exploitation of SolarWinds Web Help Desk (WHD) vulnerabilities is being used to achieve remote code execution (RCE) on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via wrapper.exe spawning java.exe in the Tomcat-based application), where attackers executed cmd.exe to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (esmahyft@proton[.]me). The activity is linked to recently disclosed WHD issues, including CVE-2025-40551 (untrusted deserialization leading to code execution, added to CISA KEV) and CVE-2025-26399, which multiple vendors have cited as being exploited in the wild.
Post-compromise, the actor used the Zoho RMM process (TOOLSIQ.EXE) as an operational foothold to run Active Directory discovery and domain enumeration (e.g., net group "domain computers" /do) consistent with preparation for lateral movement. The intrusions also included deployment of Velociraptor for endpoint control and collection, and use of Cloudflare tunnels to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Belgium's Center for Cybersecurity issued an advisory warning that SolarWinds Web Help Desk vulnerabilities were being actively exploited and urged immediate patching. The notice reflected the spread of official government warnings beyond vendor and U.S. agency reporting.
By February 9, multiple security outlets and researchers had published consolidated reporting that the campaign was actively exploiting unpatched SolarWinds WHD servers for unauthenticated RCE and follow-on abuse of legitimate admin and DFIR tools. Reporting also tied the activity to public staging services, Cloudflare Worker-fronted infrastructure, and in some cases QEMU-based SSH backdoor persistence.
On February 7, Huntress observed attackers exploit an unpatched WHD instance, then silently install Zoho Assist from Catbox, perform Active Directory reconnaissance, and deploy Velociraptor from a Supabase bucket. The actor also disabled Windows Defender and the firewall, used Cloudflared for tunnel access, and exfiltrated system information to an attacker-controlled Elastic Cloud instance.
CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog after evidence of in-the-wild exploitation. The agency ordered U.S. FCEB agencies to remediate by February 6, 2026.
On February 6, Microsoft publicly stated that SolarWinds Web Help Desk servers were under active exploitation. It described post-compromise use of PowerShell, BITS, Zoho ManageEngine tooling, reverse SSH/RDP access, credential dumping, and persistence mechanisms including scheduled tasks launching QEMU.
Microsoft Defender Research reported that it had detected multi-stage intrusions affecting customers in December 2025 through vulnerable SolarWinds WHD servers. The attacks involved lateral movement, credential theft, and in at least one case DCSync, but Microsoft could not determine which WHD CVE was used for initial access.
SolarWinds disclosed additional Web Help Desk vulnerabilities, including CVE-2025-40551 and CVE-2025-40536. These newly disclosed issues were later considered possible initial access vectors in the active intrusions.
Threat activity against internet-exposed SolarWinds Web Help Desk instances began by at least mid-January 2026, with Huntress later saying the campaign started around January 16. At least three organizations were affected in the observed activity.
A critical deserialization remote code execution flaw, CVE-2025-26399, in SolarWinds Web Help Desk was publicly disclosed. Later reporting identified it as one of the vulnerabilities present on systems that were subsequently attacked.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcecsoonline.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026
Microsoft Defender researchers reported a multi-stage intrusion campaign exploiting **internet-exposed SolarWinds Web Help Desk (WHD)** servers to establish stealthy persistence and enable lateral movement toward broader domain compromise. After initial access, attackers created a scheduled task to start a hidden **QEMU** virtual machine under `SYSTEM`, using QEMU port forwarding (e.g., `hostfwd=tcp::22022-:22`) to provide a concealed SSH access path. The activity also included credential-theft tradecraft via **DLL sideloading**, abusing `wab.exe` to load a malicious `sspicli.dll`, enabling access to **LSASS** memory while attempting to evade common detections. Separately, active exploitation was reported against **Ivanti Endpoint Manager Mobile (EPMM)** appliances following disclosure of two critical flaws—**CVE-2026-1281** (authentication bypass) and **CVE-2026-1340** (remote code execution)—with intrusions observed dropping an artifact at `/mifs/403.jsp`. The observed payloads differed from typical interactive webshells: attackers delivered a Base64-encoded Java class (with `CAFEBABE` header) acting as a **dormant in-memory class loader** (e.g., `base.Info` compiled from `Info.java`) that waits for a later activation request to load and execute a second-stage class in memory, including an unusual entry point using `equals(Object)` rather than standard servlet handlers. In parallel with these exploitation reports, two unrelated critical vulnerability disclosures were highlighted: **Keylime** registrar misconfiguration (**CVE-2026-1709**, CVSS 9.4) that effectively disables **mTLS client certificate enforcement** (affected versions `7.12.0`–`7.13.0`), and a **Microsoft Semantic Kernel .NET SDK** arbitrary file write (**CVE-2026-25592**, CVSS 10.0) in `SessionsPythonPlugin` (`DownloadFileAsync`/`UploadFileAsync`) that can allow overwriting files via insufficient path validation.
Jun 29, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026