Hackers Actively Exploiting SolarWinds Web Help Desk RCE Vulnerability to Deploy Custom Tools

Active exploitation of a SolarWinds Web Help Desk RCE is being observed: attackers silently install Zoho ManageEngine RMM agents and Velociraptor via hosted MSI payloads, perform Active Directory reconnaissance and lateral movement, disable defenses, establish Cloudflared tunnels, and exfiltrate system data to attacker-controlled Elastic infrastructure; organizations are advised to update WHD to 2026.1+, remove administrative interfaces from the internet, rotate credentials, and hunt for silent MSIs and encoded PowerShell tied to WHD processes.