Threat actors are actively targeting SolarWinds Web Help Desk (WHD) instances — particularly those exposed to the public internet.
CISA has added CVE-2025-40551 (critical deserialization flaw) to its Known Exploited Vulnerabilities (KEV) catalog, while Microsoft and Huntress report multistage intrusions against vulnerable WHD servers.
What’s happening?
🛠️ Initial Access
Attackers exploit vulnerable or unpatched WHD instances — especially those exposed online.
💻 Post-Exploitation Activity
• PowerShell + BITS for payload download
• Zoho ManageEngine / Zoho Meetings for lateral movement
• Cloudflare Tunnels for persistence
• Velociraptor abused for C2
🏢 Impact
Single exposed WHD instance → potential full domain compromise.
🌐 Exposure Risk
~170 vulnerable WHD instances still visible online (Shadowserver).
Why This Matters
“This reflects a common but high-impact pattern: one exposed application can provide a path to full domain compromise.”
Internet exposure dramatically lowers the bar for attackers — enabling large-scale scanning and “spray and pray” exploitation campaigns.
Mitigation Guidance
✔️ Upgrade to WHD 2026.1 or later
✔️ Remove direct internet access to admin paths
✔️ Place WHD behind firewall or VPN
✔️ Rotate service & admin credentials
✔️ Hunt for unauthorized RMM tools (Zoho, Velociraptor)
