SOMEONE'S ATTACKING SOLARWINDS WHD TO STEAL HIGH-PRIVILEGE CREDENTIALS - BUT WE DON'T KNOW WHO OR HOW

Summary from the TLDR InfoSec newsletter

Unknown threat actors exploited vulnerable SolarWinds Web Help Desk instances in December 2025 to gain initial access, with Microsoft unable to confirm whether the attacks leveraged CVE-2025-40551 (9.8 CVSS deserialization RCE), CVE-2025-40536 (8.1 CVSS auth bypass), or CVE-2025-26399 (9.8 CVSS command execution). Post-exploitation activity included BITS abuse for payload delivery, installation of Zoho ManageEngine RMM for persistence, LSASS credential dumping via DLL sideloading, and DCSync attacks to extract domain controller password data. Organizations should immediately patch WHD, remove public access to admin paths, scan for unauthorized RMM tools such as ToolsIQ.exe, and rotate service and admin account credentials accessible from WHD.