Security researchers warn that multiple enterprise customers have been compromised in connection with a critical flaw in SolarWinds Web Help Desk.
Huntress Labs said that three customers have been exploited, and hackers are deploying remote assist tools against compromised hosts, according to a blog post released Sunday.
The vulnerability, tracked as CVE-2025-40551, involves deserialization of untrusted data and allows an attacker to achieve remote code execution. Last Tuesday, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, just days after SolarWinds patched the vulnerability.
SolarWinds issued an advisory on Jan. 28 warning about the flaw and urged users to upgrade to a patched version. The flaw was previously discovered by researchers at Horizon3.ai.
Shadowserver on Monday reported about 150 exposed instances of Web Help Desk, a slight decrease from the 170 figure it reported last week.
In one case investigated by Huntress, a hacker deployed Zoho Meetings and Cloudflare to gain persistence and also used a tool called Velociraptor to gain command-and-control capabilities.
Researchers said that hackers used the file-hosting service Catbox to stage a remote management tool called Zoho ManageAgent RMM, before switching to hands-on-keyboard activity.
Huntress researchers believe a threat group tracked as Storm-2603 is behind the attacks.
“Normally, these types of incidents would have led to Warlock ransomware, but in this case, it seems as if the attackers were still in reconnaissance mode, since their main objectives appeared to be to collect system information from as many victims as possible,” Jamie Levy, senior director, adversary tactics, told Cybersecurity Dive.
In a separate case, researchers at Microsoft said hackers deployed a remote monitoring and management tool called Zoho ManageEngine on a compromised system, according to a blog post published Friday.
Those researchers were unable to link the activity to CVE-2025-40551 and a security control bypass flaw, tracked as CVE-2025-40536, or a prior flaw, tracked as CVE-2025-26399.
