{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/solarwinds/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["solarwinds","serv-u","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn February 25, 2026, the Centre for Cybersecurity Belgium (CCB) issued an advisory regarding four critical vulnerabilities (CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541) in SolarWinds Serv-U MFT and FTP Server. These vulnerabilities, if exploited, can lead to remote code execution (RCE) on the affected systems.  The Serv-U products are file transfer solutions widely used by organizations. While there\u0026rsquo;s no current indication of active exploitation as of the advisory\u0026rsquo;s release, the CCB anticipates potential exploitation attempts by threat actors, including ransomware groups, given their past interest in file transfer technologies. Exploitation on Windows deployments requires administrative privileges. The vulnerabilities affect SolarWinds Serv-U MFT and FTP Server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a Serv-U server, potentially through compromised credentials or other means.\u003c/li\u003e\n\u003cli\u003eAttacker exploits CVE-2025-40538 (broken access control) to create a system administrator user. This may involve sending a specially crafted request to the Serv-U server.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the newly created administrator account to gain administrative privileges.\u003c/li\u003e\n\u003cli\u003eAttacker exploits CVE-2025-40539 (type confusion) or CVE-2025-40540 (type confusion) to inject and execute arbitrary code. This could involve sending further malicious requests.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker exploits CVE-2025-40541 (Insecure Direct Object Reference) to execute native code.\u003c/li\u003e\n\u003cli\u003eThe attacker executes arbitrary commands on the server with root privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes persistence via scheduled tasks or other mechanisms.\u003c/li\u003e\n\u003cli\u003eThe attacker moves laterally within the network, exfiltrates sensitive data, deploys ransomware, or performs other malicious activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities allows attackers to execute arbitrary code with root privileges on the affected SolarWinds Serv-U servers. This could lead to full system compromise, data theft, ransomware deployment, and disruption of file transfer services.  The scope could affect organizations relying on Serv-U for critical file transfers. The CCB advisory highlights potential targeting by ransomware groups who have shown past interest in file transfer technologies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch SolarWinds Serv-U MFT and FTP Server to version 15.5.4 or later to remediate CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541 (SolarWinds advisories).\u003c/li\u003e\n\u003cli\u003eEnable and review Sysmon process creation logs for suspicious processes spawned by Serv-U processes to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eImplement network monitoring to detect unusual traffic originating from Serv-U servers, which might indicate command and control activity after successful exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-02-26T12:00:00Z","date_published":"2026-02-26T12:00:00Z","id":"/briefs/2026-02-solarwinds-servu-rce/","summary":"Multiple critical vulnerabilities in SolarWinds Serv-U MFT and FTP Server allow remote code execution, potentially leading to system compromise.","title":"Critical Vulnerabilities in SolarWinds Serv-U Allow Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-02-solarwinds-servu-rce/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Elastic Defend","SolarWinds.BusinessLayerHost.exe","SolarWinds.BusinessLayerHostx64.exe","SentinelOne Cloud Funnel"],"_cs_severities":["medium"],"_cs_tags":["supply-chain","execution","solarwinds"],"_cs_type":"advisory","_cs_vendors":["Elastic","SolarWinds","SentinelOne"],"content_html":"\u003cp\u003eThis detection rule identifies suspicious child processes initiated by SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe, excluding known legitimate operations. Adversaries may exploit the trusted SolarWinds processes to execute unauthorized programs with elevated privileges, bypassing security controls. The rule focuses on Windows systems and is designed to detect activity indicative of post-compromise actions following a supply chain attack. This detection is crucial for organizations that utilize SolarWinds software, as malicious actors could leverage compromised SolarWinds installations to gain unauthorized access and execute arbitrary code within the network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise of the SolarWinds software supply chain (T1195.002).\u003c/li\u003e\n\u003cli\u003eMalicious code is injected into SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe.\u003c/li\u003e\n\u003cli\u003eThe compromised SolarWinds process spawns a suspicious child process.\u003c/li\u003e\n\u003cli\u003eThe child process executes a malicious command or binary, attempting to evade detection.\u003c/li\u003e\n\u003cli\u003eThe child process leverages Native APIs (T1106) to perform privileged actions.\u003c/li\u003e\n\u003cli\u003eLateral movement or data exfiltration may occur from the compromised host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack can lead to the execution of arbitrary code on systems running SolarWinds software. This can result in data theft, system compromise, and further propagation of the attack throughout the network. Organizations in various sectors utilizing SolarWinds products are potentially at risk. The impact may include loss of sensitive data, disruption of critical services, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eSuspicious SolarWinds Child Process - CommandLine\u003c/code\u003e to detect potentially malicious child processes of SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eSuspicious SolarWinds Child Process - Executable\u003c/code\u003e to detect execution of unusual executables as child processes of SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging with command line details on Windows systems to ensure the Sigma rules have sufficient data.\u003c/li\u003e\n\u003cli\u003eReview and tune the rules for false positives based on legitimate SolarWinds child processes in your environment, updating the exclusion lists in the rules accordingly, referencing the \u0026ldquo;false_positives\u0026rdquo; section in the rule description.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-solarwinds-child-process/","summary":"Detection of unusual child processes spawned by SolarWinds processes may indicate malicious program execution, potentially bypassing security controls.","title":"Suspicious SolarWinds Child Process Execution","url":"https://feed.craftedsignal.io/briefs/2024-01-solarwinds-child-process/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Microsoft Defender XDR","Elastic Defend"],"_cs_severities":["medium"],"_cs_tags":["solarwinds","defense-evasion","registry-modification","supply-chain"],"_cs_type":"advisory","_cs_vendors":["SolarWinds","Microsoft","SentinelOne","Crowdstrike","Elastic"],"content_html":"\u003cp\u003eThis threat brief focuses on the detection of SolarWinds processes attempting to disable services by modifying their registry start type. This activity is associated with defense evasion tactics, potentially linked to initial access via supply chain compromise, similar to the SUNBURST campaign. The behavior involves SolarWinds binaries, such as \u003ccode\u003eSolarWinds.BusinessLayerHost*.exe\u003c/code\u003e and \u003ccode\u003eNetFlowService*.exe\u003c/code\u003e, manipulating registry entries related to service start configurations. This technique can be used to impair or disable security tools and services, allowing attackers to operate more freely within a compromised environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise of the SolarWinds Orion platform, potentially through a supply chain attack.\u003c/li\u003e\n\u003cli\u003eDeployment of a malicious module or payload within the SolarWinds environment.\u003c/li\u003e\n\u003cli\u003eExecution of a SolarWinds process, such as \u003ccode\u003eSolarWinds.BusinessLayerHost*.exe\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe SolarWinds process modifies the registry to change the start type of a service.\u003c/li\u003e\n\u003cli\u003eThe registry modification targets the \u003ccode\u003eHKLM\\SYSTEM\\ControlSet*\\Services\\*\\Start\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eStart\u003c/code\u003e value is set to \u0026ldquo;4\u0026rdquo; or \u0026ldquo;0x00000004\u0026rdquo;, which disables the targeted service.\u003c/li\u003e\n\u003cli\u003eDisabling critical security services allows the attacker to evade detection and further compromise the system.\u003c/li\u003e\n\u003cli\u003eAttacker achieves persistence and performs lateral movement, exfiltrating data or deploying ransomware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to the disabling of critical security services, such as antivirus, endpoint detection and response (EDR) agents, or other monitoring tools. This can significantly reduce the visibility of malicious activity within the network, potentially leading to data breaches, ransomware deployment, or other severe security incidents. The SolarWinds supply chain compromise affected numerous organizations globally, underscoring the potential impact of this type of attack.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eSolarWinds Process Disabling Services via Registry\u003c/code\u003e to your SIEM to detect registry modifications by SolarWinds processes aimed at disabling services.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon registry event logging to provide the necessary data for the Sigma rule to function effectively.\u003c/li\u003e\n\u003cli\u003eReview and harden access controls for SolarWinds processes to restrict their ability to modify critical system settings.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the affected service and the timeline of events surrounding the registry modification.\u003c/li\u003e\n\u003cli\u003eUtilize threat intelligence platforms to stay informed about known SolarWinds-related attack patterns and indicators of compromise (IOCs).\u003c/li\u003e\n\u003cli\u003eMonitor endpoints for unusual behavior by SolarWinds processes, including network connections, file modifications, and process creations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-solarwinds-service-disable/","summary":"A SolarWinds binary is modifying the start type of a service to be disabled via registry modification, potentially to disable or impair security services.","title":"SolarWinds Process Disabling Services via Registry Modification","url":"https://feed.craftedsignal.io/briefs/2024-01-solarwinds-service-disable/"}],"language":"en","title":"CraftedSignal Threat Feed — Solarwinds","version":"https://jsonfeed.org/version/1.1"}