Loading story…
Microsoft Defender researchers reported a multi-stage intrusion campaign exploiting internet-exposed SolarWinds Web Help Desk (WHD) servers to establish stealthy persistence and enable lateral movement toward broader domain compromise. After initial access, attackers created a scheduled task to start a hidden QEMU virtual machine under SYSTEM, using QEMU port forwarding (e.g., hostfwd=tcp::22022-:22) to provide a concealed SSH access path. The activity also included credential-theft tradecraft via DLL sideloading, abusing wab.exe to load a malicious sspicli.dll, enabling access to LSASS memory while attempting to evade common detections.
Separately, active exploitation was reported against Ivanti Endpoint Manager Mobile (EPMM) appliances following disclosure of two critical flaws—CVE-2026-1281 (authentication bypass) and CVE-2026-1340 (remote code execution)—with intrusions observed dropping an artifact at /mifs/403.jsp. The observed payloads differed from typical interactive webshells: attackers delivered a Base64-encoded Java class (with CAFEBABE header) acting as a dormant in-memory class loader (e.g., base.Info compiled from Info.java) that waits for a later activation request to load and execute a second-stage class in memory, including an unusual entry point using equals(Object) rather than standard servlet handlers. In parallel with these exploitation reports, two unrelated critical vulnerability disclosures were highlighted: Keylime registrar misconfiguration (CVE-2026-1709, CVSS 9.4) that effectively disables mTLS client certificate enforcement (affected versions 7.12.0–7.13.0), and a Microsoft Semantic Kernel .NET SDK arbitrary file write (CVE-2026-25592, CVSS 10.0) in SessionsPythonPlugin (DownloadFileAsync/UploadFileAsync) that can allow overwriting files via insufficient path validation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft Defender Research disclosed the SolarWinds WHD campaign and advised organizations to patch WHD, restrict public exposure of administrative paths, and hunt for QEMU-based persistence and unauthorized remote management artifacts.
Shadowserver separately observed webshell deployment on Ivanti EPMM devices and reported 56 IP addresses as compromised. The finding indicated active exploitation at measurable scale.
Attackers were observed exploiting Ivanti EPMM appliances to drop a Base64-encoded Java class at /mifs/403.jsp that functioned as an in-memory class loader awaiting later activation. Defusedcyber verified the loader deployment without second-stage execution, indicating an implant-now-operate-later approach.
Two critical Ivanti Endpoint Manager Mobile vulnerabilities, CVE-2026-1281 and CVE-2026-1340, were disclosed prior to active exploitation being reported. These flaws enabled unauthenticated access to exposed EPMM appliances.
After compromising SolarWinds WHD, attackers created a scheduled task to launch a hidden QEMU virtual machine as SYSTEM and used port forwarding for covert SSH access. The campaign also used DLL sideloading and LSASS access for credential theft, and in at least one case enabled a DCSync attack for domain password replication.
Microsoft Defender Research observed a sophisticated intrusion campaign targeting internet-exposed SolarWinds Web Help Desk servers in December 2025. Attackers gained initial access through an unconfirmed vulnerability amid multiple concurrent WHD flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Ivanti Endpoint Manager Mobile (EPMM)** is being actively exploited via two critical, unauthenticated remote code execution vulnerabilities, **CVE-2026-1281** and **CVE-2026-1340** (both reported as CVSS 9.8). Reporting describes attackers achieving full control of exposed EPMM/MDM infrastructure, including establishing reverse shells, deploying web shells, performing reconnaissance, and downloading additional malware; activity has been observed across multiple countries and sectors (including government, healthcare, manufacturing, and technology). **CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities (KEV) Catalog**, and defenders are urged to apply Ivanti’s available fixes/updates per the vendor advisory. Telemetry and threat-intel observations indicate broad internet exposure and automation in exploitation. Unit 42 reported visibility into **4,400+** EPMM instances, and noted threat actors shifting from initial exploitation toward **dormant backdoors** intended to preserve access even after patching. GreyNoise data highlighted that a large share of observed exploitation traffic (reported as **83%**) originated from a single IP, `193.24.123.42`, associated with “bulletproof” hosting, with attackers rotating user-agent strings consistent with mass scanning/exploitation; the same infrastructure was also linked to attempts against other products (e.g., Oracle WebLogic, `telnetd`, and GLPI).
Jun 29, 2026
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, including a critical **SolarWinds Web Help Desk (WHD)** security protection bypass tracked as `CVE-2025-40536` (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in *WHD 2026.1*. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether `CVE-2025-40536` was the specific vulnerability exploited. Rapid7 reported that **Metasploit added exploit module support for SolarWinds WHD vulnerabilities `CVE-2025-40536` and `CVE-2025-40551`**, enabling post-exploitation sessions running as `NT AUTHORITY\SYSTEM` when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Jun 29, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026