Solar Winds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers
Summary: Microsoft observed a multi-stage intrusion in December 2025 in which threat actors exploited internet-exposed SolarWinds Web Help Desk instances for unauthenticated remote code execution, then spawned PowerShell to use BITS for payload download and deployed legitimate Zoho ManageEngine RMM components for persistent remote control, with at least one case involving a DCSync attack against Active Directory. Microsoft said it could not reliably confirm whether the activity used CVE-2025-40551 or CVE-2025-40536 or the previously patched CVE-2025-26399, and CISA added CVE-2025-40551 to its KEV catalog with a February 6, 2026 remediation deadline for FCEB agencies.
What you should know: Huntress linked the campaign to infrastructure and tradecraft it had seen in prior ToolShell and Warlock ransomware activity, and found an attacker-controlled Elastic Cloud instance holding about 216 unique victim hosts across government, finance, manufacturing and other sectors - a single exposed help desk application was enough to reach domain compromise.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-26399CVE-2025-40536CVE-2025-40551
- Related