Active Exploitation of SolarWinds Web Help Desk RCE Used to Drop Custom Malware

Threat actors are actively exploiting critical vulnerabilities in SolarWinds Web Help Desk (WHD) to deploy custom malware and establish persistent remote control.

Security researchers observed these attacks starting on February 7, 2026, targeting organizations that had not yet applied the latest security patches.

SolarWinds Web Help Desk RCE

The intrusion leverages recently disclosed Remote Code Execution (RCE) vulnerabilities, specifically CVE-2025-40551 and CVE-2025-26399.

Researchers at Huntress observed that the attack begins when the WHD service wrapper (wrapper.exe) spawns a Java process to execute malicious commands.

This process silently installs a Zoho ManageEngine RMM agent via a Windows Installer (MSI) payload hosted on the file-sharing service Catbox.

Once installed, the Zoho agent acts as a backdoor, configured for unattended access and linked to an attacker-controlled Proton Mail account.

This legitimate remote management tool allows adversaries to maintain hands-on access to the compromised environment without raising immediate alarms.

A defining feature of this campaign is the abuse of legitimate software for malicious purposes.

After establishing a foothold, the attackers deploy Velociraptor, an open-source digital forensics tool typically used by defenders.

In this context, an outdated version of Velociraptor is weaponized as a Command and Control (C2) framework, communicating with a malicious Cloudflare Worker domain to execute PowerShell commands on the victim’s machine.

To manage their victims, the attackers utilize a custom PowerShell script that harvests system information, such as OS version and domain membership.

In an ironic twist, this data is formatted and exfiltrated directly to an attacker-controlled Elastic Cloud instance.

The threat actors are essentially using a legitimate SIEM (Security Information and Event Management) platform to triage their compromised targets.

Advanced Persistence and Evasion

The campaign exhibits sophisticated tradecraft to ensure the attack survives defensive countermeasures:

• Defense Evasion: The attackers execute registry modifications to forcibly disable Windows Defender, turning off real-time monitoring and anti-spyware protections.
• C2 Failover: The malware includes a unique redundancy script. It periodically probes a specific dynamic DNS domain. If the server returns a particular HTTP 406 error code, the script automatically rewrites the Velociraptor configuration file to switch the command-and-control servers. This allows attackers to rotate infrastructure instantly if their primary domain is blocked.

Organizations using SolarWinds Web Help Desk should immediately verify the installed version at C:Program FilesWebHelpDeskversion.txt.

All versions before 12.8.7 HF1 are vulnerable. Administrators must immediately apply the official SolarWinds update to close this critical security gap.

Indicators of compromise (IOCs)

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google