SolarWinds Web Help Desk Exploited for RCE in Multi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-26399 | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 90% | KEVRansomware | KEV |
CVE-2025-40551+1 related CVE | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 84% | KEV | KEV |
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | firstmail.ltd | count with a throwaway email address likely generated using firstmail[.]ltd, a Russia-based disposable mail service. In all, the thre |
| domain | mooo.com | ciraptor agent to connect it to a different server ("v2-api.mooo[.]com") if the original Cloudflare workers[.]dev domain has bee |
| ipv4 | 154.26.156.181 | d instance originated from the following two IP addresses - 154.26.156[.]181 51.161.152[.]26 It's worth noting that the IP address 51. |
| ipv4 | 51.161.152.26 | ated from the following two IP addresses - 154.26.156[.]181 51.161.152[.]26 It's worth noting that the IP address 51.161.152[.]26, an |
From the original article
6 min read at thehackernews.com
Microsoft has revealed that it observed a multi‑stage intrusion that involved the threat actors exploiting internet‑exposed SolarWinds Web Help Desk (WHD) instances to obtain initial access and move laterally across the organization's network to other high-value assets.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.