Multiple Researchers Confirm Active Exploitation of SolarWinds Web Help Desk Instances

Summary

Threat actors are actively exploiting critical vulnerabilities in internet-exposed SolarWinds Web Help Desk (WHD) instances to achieve unauthenticated remote code execution. These intrusions follow a high-impact pattern where a single unpatched application serves as a gateway for lateral movement and full domain compromise. Once inside, attackers deploy a mix of legitimate remote monitoring tools and specialized command-and-control frameworks to maintain persistent access. While the specific vulnerabilities exploited are not actively identified, CVE-2025-40551 was recently added to CISA’s Known Exploited Vulnerabilities database, CVE-2025-40536, and CVE-2025-26399 was just recently discussed by Microsoft and other vendors who have also observed active in-the-wild exploitation. Security teams are urged to patch all WHD versions prior to 12.8.7 HF1 immediately and monitor unauthorized administrative tool installations.

Technical Analysis

The exploit chain begins when the vulnerable WHD service wrapper spawns a Java process that initiates PowerShell or cmd[.]exe to retrieve malicious payloads via BITS or msiexec. These payloads often include the Zoho ManageEngine RMM agent, which threat actors use to conduct hands-on-keyboard reconnaissance of Active Directory environments. In several instances, attackers utilized the file-hosting services Catbox and Supabase to stage malicious MSI installers while registering agents to anonymous Proton Mail accounts.

Persistence is frequently established through reverse SSH tunnels and the creation of scheduled tasks designed to launch QEMU virtual machines, effectively masking malicious traffic within a virtualized SYSTEM context. To further evade detection, threat actors perform DLL sideloading by abusing wab.exe to load a malicious sspicli.dll, facilitating direct access to LSASS memory and credential theft. Lateral movement follows textbook patterns, starting with domain computer enumeration and escalating to DCSync attacks that request password data directly from domain controllers.

Defenders have also observed the deployment of Velociraptor, a legitimate forensics tool, repurposed as a command-and-control framework through customized configuration files pointing to Cloudflare Workers.

Remediation requires the immediate isolation of compromised hosts, rotation of high-privilege service credentials, and the thorough removal of unauthorized RMM artifacts like TOOLSIQ.EXE.

Indicators of Compromise

Huntress provided the following Indicators of Compromise for revie and ingestion related to recent SolarWinds exploitation.