Tech
Researchers delve inside new SolarWinds RCE attack chain | Computer Weekly
Researchers at Huntress Security have published new data on exploitation of a critical SolarWinds Web Help Desk (WHD) vulnerability, revealing how in at least three known incidents, attackers conducted extensive post-exploitation activity with a common set of tools, including legitimate services such as Zoho ManageEngine and Elastic
Tracked as CVE-2025-40551, the data deserialisation vulnerability was first flagged by SolarWinds on 28 January and last week, was added to the US Cybersecurity and Infrastructure Security Agency’s (Cisa) Known Exploited Vulnerabilities (Kev) resource mandating that US government bodies fix it immediately.
“Threat actors are actively weaponising WHD vulnerabilities to achieve remote code execution [RCE] and deploy additional tooling in victim environments,” said the Huntress team.
The research team at Huntress – which protects multiple SolarWinds customers through its channel – found that having broken into their victim environments, the attackers took control of WMD’s service wrapper to spawn the underlying Java application, which enabled them to install a payload, which was in fact a Zoho ManageEngine remote monitoring and management (RMM) agent.
This done, the threat actor used the RMM agent to execute several Active Directory discovery commands to enumerate the environment. Shortly after this, they opened a Zoho Assist remote session which they used to install the open source digital forensics and incident response (DFIR) tool Velociraptor.
“While Velociraptor is designed to help defenders with endpoint monitoring and artifact collection, its capabilities, such as remote command execution, file retrieval, and process execution via VQL queries, make it equally effective as a C2 [Command and Control] framework when pointed at attacker-controlled infrastructure,” said Huntress.
In the instances its team investigated, the attackers were actually using a rather outdated version of Velociraptor that itself contained a privilege escalation flaw disclosed in 2025. Moreover, the Velociraptor server infrastructure pointed back to a known Cloudflare account associated with the Warlock ransomware operation, a possible hint to the provenance of the campaign.
Alongside Velociraptor, the threat actor also downloaded Cloudflared, the command line client for Cloudflare Tunnel, likely in order to establish a second redundant means of access.
They then proceeded to execute a PowerShall script to collect system information – data such as operating system version, hardware spec, domain membership, installed hotfixes – that was exfiltrated to a legitimate Elastic Cloud instance being run as a free trial on Elastic’s software-as-a-service (SaaS) infrastructure.
The researchers said it was somewhat ironic that the threat actor had essentially built themselves a security information and event management (SIEM) solution on Elastic’s infrastructure to triage their victims.
“Elastic’s own tooling, typically used by defenders for threat hunting and incident response, was repurposed as an attacker’s victim management dashboard,” they said.
“We have reported this malicious instance to Elastic as well as law enforcement and performed victim notification and outreach to non-Huntress partners,” said the Huntress team.
Microsoft reports on further attacks
Huntress’ full write-up of its research, available to read in full here, details various other actions taken by the threat actor during the course of their intrusions. Meanwhile, in addition to these findings, Microsoft has published details of a similar multi-stage intrusion orchestrated via SolarWinds WHD, although it has not yet been able to establish whether or not the attackers exploited CVE-2025-40551 or CVE-2025-26399 – another RCE bug disclosed in September 2025 that bypassed a previously fixed flaw that in turn bypassed a third issue first flagged in 2024.
The incident investigated by Microsoft saw the attackers use the compromised WHD instance to spawn PowerShell in order to download and execute Zoho ManageEngine to gain control of the system after which they conducted recon activity while setting up reverse secure shell (SSH) and remote desktop protocol (RDP) access to maintain their bridgehead.
Microsoft also observed the attackers creating a scheduled task to launch a QEMU virtual machine under the SYSTEM account on startup, which essentially let them hide their activity within the virtualised environment. Huntress had also noted this in some instances.
On some hosts, Microsoft said the attackers also used dynamic link library (DLL) sideloading to gain access to Local Security Authority Subsystem Service (LSASS) memory in order to steal more credentials.
Besides patching and isolating compromised hosts, Microsoft is advising its users to evict any RMM artifacts, particularly any associated with ManageEngine, that may have been added after exploitation, and immediately rotate credentials for all service and admin accounts accessible from WHD.
Tech
I Tested Garmin Watches for a Decade While Hiking, Biking, and Climbing. Here’s What You Should Buy
Last year, Garmin introduced a Pro version that incorporates the inReach’s satellite communications savvy. Not only does it cost at least $400 more than the Apple Watch Ultra and $200 more than the regular Fenix 8, but you also have to pay for the inReach subscription plan, which has several tiers and ranges from $8/month to $50/month depending on whether you want features like unlimited texting or sending photo messages.
What you get for this mind-boggling price is a sports watch that can do anything and everything. It has best-in-class battery life (every Fenix can last for weeks on a single charge, and up to a month with solar charging) and features like the depth sensor from Garmin’s Descent line, which means this watch works as a full-on dive computer for scuba and free diving. It has a microphone and speaker for basic voice commands (although no onboard cellular connectivity), the surprisingly useful built-in LED flashlight, and Garmin’s signature built-in topographic maps, 24/7 health monitoring, and tracking for over a hundred different activities.
I’ve taken the 51-mm version on pretty much every outdoor sport—snowboarding, trail running, mountain biking, and rock climbing. Every time I use it, its capabilities far outclass my own. I have irritated many a fellow climber by attempting to track route difficulty, duration, and falls while integrating my Body Battery metrics and so on. The danger is always that you’ll spend more time fiddling with your Garmin Fenix 8 than you do with your actual sport. I have the version with the sapphire glass face and the titanium bezel, and have smashed it into rock faces with nary a scratch. If you’re up for paying the price and want a good-looking watch that will last forever (I have friends who are still wearing their Fenix 5s and 6s, and honestly, they’re fine), this is the one to get.
Best Running Watch
The Garmin Forerunner series launched in the early 2000s and has become the quintessential runner’s watch. Like all Garmins, the Forerunner comes in a range of price points, each offering different features. Last year, Garmin released the Forerunner 570 ($550), a midrange model with no LED flashlight or onboard maps, and the Forerunner 970 ($750), which is the premium version. Before I go into detail about why the Forerunner 970 is the best option, I should also say that I have tested many previous Garmin Forerunners at various price points. If you’re not a triathlete, the older Forerunners are still worth considering, and the entry-level $200 Forerunner 165 is aimed explicitly at runners, instead of including triathletes as the more expensive models do.
Tech
Save Up to 40% With These Acer Promo Codes and Discounts
Acer is one of the top largest PC manufacturers in the world, perhaps best known for its gaming line and budget-friendly options. If you’ve already got your eye on an Acer product like a laptop or monitor, and are shopping at the company’s online storefront, you should be using one of these Acer promo codes and coupons to save some cash on your purchase.
Save 40% on Accessories When You Build an Acer Bundle
If you’re buying from Acer, you’re most likely shopping for either a desktop PC or laptop. With this discount, you can get a really solid deal on accessories if you bundle it with a mouse, laptop bag, or headset. When you go to purchase a PC, just click “Build Bundle” and you’ll see some of the eligible options, all of which are reduced by 40%. The Nitro Mechanical Keyboard, for example, goes from $50 to just $30. That 40% is a real discount, too, as that same keyboard costs $50 on Amazon when I checked.
Beyond peripheral add-ons, you can also save 10% off Acer Care Plus extended service plans or McAfee LiveSafe antivirus subscriptions. You can bundle up to five products together to save the most money. If you’re headed off to college (or have a kid in the family), a bundle like this can get you everything you need for a gaming or studying setup on the go.
Shop Rotating Weekly Deals on Monitors and Gaming Gear
Acer’s PC gaming offerings come in either the flagship Predator brand or the budget-tier Nitro. Acer offers rotating weekly deals on everything from monitors to gaming laptops, some of which are my favorites that I’ve tested in their given category. The Acer Nitro V 16, for example, was a budget gaming laptop that I recommended quite a lot last year because of its incredible price. The one I tested was the entry-level version with an Nvidia RTX 5050 inside, but Acer has the RTX 5060 model in its own storefront. It’s $100 off right now at $1,200, which comes with 16 GB of RAM and a terabyte of storage. In fact, it’s only $30 more than the RTX 5050 model, despite offering a significant jump in gaming performance. These discounts are reflected right on the product pages, so there’s no promo code, discount code, or coupon code required.
Acer has a wide selection of monitors available, too, whether that’s a massive 49-incher or a more modest 27-inch gaming workhorse. One of my favorite discounts I saw right now was the Acer Nitro XV2, a 27-inch 1440p display with a 300 Hz refresh rate. It’s 44% off at the time of writing, bringing the price down to just $250. Because these discounts are swapped out on a weekly basis, it’s worth checking back to see if the product you’re eyeing has a new discount.
Select Customers Can Get 15% Off Their Purchase
Acer also offers a number of added discounts at checkout, including 15% off for students. Students will need to verify through Student Beans or SheerID. Because a lot of the devices Acer offers are budget-friendly, they can be attractive for students, and the extra 15% off is the icing on the cake.
We tested the Acer Swift 16 AI last year and really enjoyed the high-resolution, OLED screen and impressively quiet performance. Acer has the smaller version of this same laptop available, the Swift 14 AI, which is currently $150 off. You also might check out the Acer Chromebook Plus 514, a laptop we liked quite a bit when we reviewed it in 2024.
Acer offers this same 15% discount for active duty military, veterans, and their families. It also applies to healthcare professionals, which can be verified through its healthcare discount portal.
Tech
AI Research Is Getting Harder to Separate From Geopolitics
The world’s top AI research conference, the Conference on Neural Information Processing Systems—better known as NeurIPS—became the latest organization this week to become embroiled in a growing clash between geopolitics and global scientific collaboration. The conference’s organizers announced and then quickly reversed controversial new restrictions for international participants after Chinese AI researchers threatened to boycott the event.
“This is a potential watershed moment,” says Paul Triolo, a partner at the advisory firm DGA-Albright Stonebridge who studies US-China relations. Triolo argues that attracting Chinese researchers to NeurIPS is beneficial to US interests, but some American officials have pushed for American and Chinese scientists to decouple their work—especially in AI, which has become a particularly sensitive topic in Washington.
The incident could deepen political tensions around AI research, as well as dissuade Chinese scientists from working at US universities and tech companies in the future. “At some level now it is going to be hard to keep basic AI research out of the [political] picture,” Triolo says.
In its annual handbook for paper submissions, issued in mid-March, NeurIPS organizers announced updated restrictions for participation. The rules stated that the event could not provide services including “peer review, editing, and publishing” to any organizations subject to US sanctions, and linked to a database of sanctioned entities. It included companies and organizations on the Bureau of Industry and Security’s entity list and those on another list with alleged ties to the Chinese military.
The new rules would have affected researchers at Chinese companies like Tencent and Huawei who regularly present work at NeurIPS. The database also includes entities from other countries such as Russia and Iran. The US places limits on doing business with these organizations, but there are no rules around academic publishing or conference participation.
The NeurIPS handbook has since been updated to specify that the restrictions apply only to Specially Designated Nationals and Blocked Persons, a list used primarily for terrorist groups and criminal organizations.
“In preparing the NeurIPS 2026 handbook, we included a link to a US government sanctions tool that covers a significantly broader set of restrictions than those NeurIPS is actually required to follow,” the event’s organizers said in a statement issued Friday. “This error was due to miscommunication between the NeurIPS Foundation and our legal team.”
Before they reversed course, the conference organizers initially said that the new rule was “about legal requirements that apply to the NeurIPS Foundation, which is responsible for complying with sanctions,” adding that it was seeking legal consultation on the issue.
Immediate Backlash
The new rule drew swift backlash from AI researchers around the world, particularly in China, which produces a large quantity of cutting-edge machine learning papers and is home to a growing share of the world’s top AI talent. Several academic groups there issued statements condemning the measure and, more importantly, discouraging Chinese academics from attending NeurIPS in the future. Some urged Chinese academics to contribute instead to domestic research conferences, potentially helping increase the country’s influence in relevant science and tech fields.
The China Association of Science and Technology (CAST), an influential government-affiliated organization for scientists and engineers, said Thursday that it would stop providing funding for Chinese scholars traveling to attend NeurIPS and would use the money instead to support domestic and international conferences that “respect the rights of Chinese scholars.”
CAST also said it will no longer count publications at the 2026 NeurIPS conference as academic achievements when evaluating future research funding. It’s unclear if the organization will reverse course now that NeurIPS has walked back the new rule.
-
Business1 week agoFlipkart group CFO to leave co amid IPO plans – The Times of India
-
Business1 week agoVideo: The Effects of High Oil Prices
-
Fashion1 week agoChina’s textile & apparel exports surge 17% to $50 bn in Jan-Feb 2026
-
Sports1 week agoRating Adidas’ 2026 World Cup away shirts: Argentina, Spain, Mexico and more
-
Sports1 week agoAmerican Conference Commissioner Tim Pernetti thanks Trump for Army-Navy game executive order
-
Tech1 week ago
The Corsair 4000D RS PC Case Keeps Your System Cool
-
Tech1 week agoGamers Hate Nvidia’s DLSS 5. Developers Aren’t Crazy About It, Either
-
Tech1 week ago‘Uncanny Valley’: Nvidia’s ‘Super Bowl of AI,’ Tesla Disappoints, and Meta’s VR Metaverse ‘Shutdown’
