Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks

Researchers observed an active campaign (starting mid-January) exploiting critical, internet‑exposed SolarWinds Web Help Desk RCE vulnerabilities to compromise at least three organizations. The attackers installed Zoho ManageEngine Assist for hands‑on access, deployed Velociraptor as a C2 mechanism via Cloudflare Workers, used Cloudflared tunnels for persistence and redundancy, disabled Windows Defender/Firewall, and employed scheduled tasks and SSH backdoors; Huntress published Sigma rules and IoCs and recommended upgrading SolarWinds WHD and removing public access.