Hackers Exploit SolarWinds WHD Vulnerabilities to Deploy Malicious Tools

Hackers have been exploiting vulnerabilities in SolarWinds Web Help Desk (WHD), specifically CVE-2025-40551 and CVE-2025-26399, to deploy legitimate tools for malicious purposes. This activity was identified by Huntress Security, which noted that the attacks began on January 16, 2026. The threat actor targeted at least three organizations, using tools like Zoho ManageEngine and Velociraptor to establish command and control (C2) capabilities.

After gaining access, the attackers installed the Zoho ManageEngine Assist agent and configured it for unattended access, linking it to an anonymous Proton Mail account. They also deployed Velociraptor, a digital forensics and incident response tool, which has been previously warned about by Cisco Talos for its misuse in ransomware attacks. The attackers used an outdated version of Velociraptor, which is vulnerable to privilege escalation, further complicating the security landscape.

The attackers utilized Cloudflare tunnels for persistent access and disabled Windows Defender and Firewall to facilitate their operations. They also created a scheduled task to maintain access through an SSH backdoor. These actions highlight the sophisticated nature of the attack chain, which involved multiple stages and tools.

Implications for Cybersecurity

This incident underscores the importance of timely updates and security measures for organizations using SolarWinds WHD. The vulnerabilities exploited are rated as critical, allowing remote code execution without authentication. Organizations should be vigilant about their configurations and access controls to mitigate similar risks.

System administrators are advised to upgrade SolarWinds WHD to version 2026.1 or later and to remove public internet access to admin interfaces. Resetting all associated credentials is also crucial to prevent unauthorized access.

Huntress has provided Sigma rules and indicators of compromise to assist in detecting related malicious activities, including silent MSI installations and encoded PowerShell executions. Organizations should implement these detection mechanisms to enhance their security posture against such attacks.