Huntress Details Active Exploitation of SolarWinds Web Help Desk

Feb 8, 2026 · Original article ↗

Summary

Huntress observed SolarWinds Web Help Desk exploitation across three customers, documenting attackers’ use of remote-access tools, Velociraptor, Cloudflare tunnels, Elastic Cloud for system data, and QEMU persistence. It urges organizations to update and review exposed

Key points

Huntress attributed the observed intrusions to vulnerabilities affecting SolarWinds Web Help Desk; versions before 12.8.7 HF1 are described as vulnerable.
The Web Help Desk service launched a Java process that installed a Zoho remote-management agent, which attackers used for hands-on access and domain reconnaissance.
Attackers deployed Velociraptor as a command-and-control tool, with a Cloudflare Worker server and a script to switch to a backup domain.
A PowerShell script collected host details and sent them to an attacker-controlled Elastic Cloud deployment; Huntress reported the instance to Elastic and law enforcement.
The observed activity included attempts to disable Windows Defender and the Windows Firewall, and use of QEMU in a scheduled task to maintain SSH access.
Huntress recommends upgrading to SolarWinds Web Help Desk 2026.1 or later, restricting administrative access, resetting relevant passwords, and checking for unauthorized tools and activity.

Article Details

Attack Vectors: Threat actors exploited SolarWinds Web Help Desk vulnerabilities to achieve remote code execution.
The compromised WHD service launched cmd.exe to silently install remote MSI payloads.
The attackers used Zoho Assist for unattended remote access and deployed Velociraptor for command and control.
The attackers used Cloudflare tunnels and a Velociraptor failover domain for redundant access.
Encoded PowerShell commands collected system information, disabled security controls, and sent host data to an attacker-controlled Elastic Cloud deployment.
A scheduled task named TPMProfiler used QEMU to open an SSH backdoor for persistence.
Defensive Notes: Upgrade SolarWinds Web Help Desk to version 2026.1 or later; the article identifies all prior versions as vulnerable.
Keep WHD administrative interfaces behind a VPN or firewall and remove direct internet access to admin paths.
Reset service-account, administrator, and other credentials accessible through or stored in WHD.
Review WHD hosts for unauthorized remote access tools, unexpected services, encoded PowerShell, and silent MSI installations spawned by java.exe or wrapper.exe.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`v2-api[.]mooo[.]com`	Velociraptor failover C2 domain configured as the backup when the operator signals a switch.
EMAIL	`esmahyft@proton[.]me`	Email address tied to the Zoho Assist account used to register a compromised host for unattended access.
SHA256	`34b2a6c334813adb2cc70f5bd666c4afbdc4a6d8a58cc1c7a902b13bbd2381f4`	Hash listed for the portable VS Code binary associated with attacker tunneling activity.
SHA256	`46831be6e577e3120084ee992168cca5af2047d4a08e3fd67ecd90396393b751`	Hash listed for the Velociraptor installer delivered from the attacker-controlled storage URL.
SHA256	`897eae49e6c32de3f4bfa229ad4f2d6e56bcf7a39c6c962d02e5c85cd538a189`	Hash listed for the MSI delivered from the Catbox URL as the Zoho Meetings Installer.
SHA256	`bbd6e120bf55309141f75c85cc94455b1337a1a4333f6868b245b2edfa97ef44`	Hash listed for the Velociraptor client configuration file associated with the attacker’s C2 setup.
URL	`hxxps[:]//auth[.]qgtxtebl[.]workers[.]dev/`	Velociraptor server URL used as attacker C2 infrastructure.
URL	`hxxps[:]//files[.]catbox[.]moe/tmp9fc.msi`	Payload-delivery URL used to install a Zoho remote management agent.
URL	`hxxps[:]//vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/code.txt`	Attacker-used storage URL associated with the portable VS Code binary downloaded to the compromised host.
URL	`hxxps[:]//vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4.msi`	Attacker-controlled storage URL used to deliver the Velociraptor installer.