Tech
Researchers delve inside new SolarWinds RCE attack chain | Computer Weekly
Researchers at Huntress Security have published new data on exploitation of a critical SolarWinds Web Help Desk (WHD) vulnerability, revealing how in at least three known incidents, attackers conducted extensive post-exploitation activity with a common set of tools, including legitimate services such as Zoho ManageEngine and Elastic
Tracked as CVE-2025-40551, the data deserialisation vulnerability was first flagged by SolarWinds on 28 January and last week, was added to the US Cybersecurity and Infrastructure Security Agency’s (Cisa) Known Exploited Vulnerabilities (Kev) resource mandating that US government bodies fix it immediately.
“Threat actors are actively weaponising WHD vulnerabilities to achieve remote code execution [RCE] and deploy additional tooling in victim environments,” said the Huntress team.
The research team at Huntress – which protects multiple SolarWinds customers through its channel – found that having broken into their victim environments, the attackers took control of WMD’s service wrapper to spawn the underlying Java application, which enabled them to install a payload, which was in fact a Zoho ManageEngine remote monitoring and management (RMM) agent.
This done, the threat actor used the RMM agent to execute several Active Directory discovery commands to enumerate the environment. Shortly after this, they opened a Zoho Assist remote session which they used to install the open source digital forensics and incident response (DFIR) tool Velociraptor.
“While Velociraptor is designed to help defenders with endpoint monitoring and artifact collection, its capabilities, such as remote command execution, file retrieval, and process execution via VQL queries, make it equally effective as a C2 [Command and Control] framework when pointed at attacker-controlled infrastructure,” said Huntress.
In the instances its team investigated, the attackers were actually using a rather outdated version of Velociraptor that itself contained a privilege escalation flaw disclosed in 2025. Moreover, the Velociraptor server infrastructure pointed back to a known Cloudflare account associated with the Warlock ransomware operation, a possible hint to the provenance of the campaign.
Alongside Velociraptor, the threat actor also downloaded Cloudflared, the command line client for Cloudflare Tunnel, likely in order to establish a second redundant means of access.
They then proceeded to execute a PowerShall script to collect system information – data such as operating system version, hardware spec, domain membership, installed hotfixes – that was exfiltrated to a legitimate Elastic Cloud instance being run as a free trial on Elastic’s software-as-a-service (SaaS) infrastructure.
The researchers said it was somewhat ironic that the threat actor had essentially built themselves a security information and event management (SIEM) solution on Elastic’s infrastructure to triage their victims.
“Elastic’s own tooling, typically used by defenders for threat hunting and incident response, was repurposed as an attacker’s victim management dashboard,” they said.
“We have reported this malicious instance to Elastic as well as law enforcement and performed victim notification and outreach to non-Huntress partners,” said the Huntress team.
Microsoft reports on further attacks
Huntress’ full write-up of its research, available to read in full here, details various other actions taken by the threat actor during the course of their intrusions. Meanwhile, in addition to these findings, Microsoft has published details of a similar multi-stage intrusion orchestrated via SolarWinds WHD, although it has not yet been able to establish whether or not the attackers exploited CVE-2025-40551 or CVE-2025-26399 – another RCE bug disclosed in September 2025 that bypassed a previously fixed flaw that in turn bypassed a third issue first flagged in 2024.
The incident investigated by Microsoft saw the attackers use the compromised WHD instance to spawn PowerShell in order to download and execute Zoho ManageEngine to gain control of the system after which they conducted recon activity while setting up reverse secure shell (SSH) and remote desktop protocol (RDP) access to maintain their bridgehead.
Microsoft also observed the attackers creating a scheduled task to launch a QEMU virtual machine under the SYSTEM account on startup, which essentially let them hide their activity within the virtualised environment. Huntress had also noted this in some instances.
On some hosts, Microsoft said the attackers also used dynamic link library (DLL) sideloading to gain access to Local Security Authority Subsystem Service (LSASS) memory in order to steal more credentials.
Besides patching and isolating compromised hosts, Microsoft is advising its users to evict any RMM artifacts, particularly any associated with ManageEngine, that may have been added after exploitation, and immediately rotate credentials for all service and admin accounts accessible from WHD.
Tech
Magnetic mixer improves 3D bioprinting
3D bioprinting, in which living tissues are printed with cells mixed into soft hydrogels, or “bio-inks,” is widely used in the field of bioengineering for modeling or replacing the tissues in our bodies. The print quality and reproducibility of tissues, however, can face challenges. One of the most significant challenges is created simply by gravity — cells naturally sink to the bottom of the bioink-extruding printer syringe because the cells are heavier than the hydrogel around them.
“This cell settling, which becomes worse during the long print sessions required to print large tissues, leads to clogged nozzles, uneven cell distribution, and inconsistencies between printed tissues,” explains Ritu Raman, the Eugene Bell Career Development Professor of Tissue Engineering and assistant professor of mechanical engineering at MIT. “Existing solutions, such as manually stirring bioinks before loading them into the printer, or using passive mixers, cannot maintain uniformity once printing begins.”
In a study published Feb. 2 in the journal Device, Raman’s team introduces a new approach that aims to solve this core limitation by actively preventing cell sedimentation within bioinks during printing, allowing for more reliable and biologically consistent 3D printed tissues.
“Precise control over the bioink’s physical and biological properties is essential for recreating the structure and function of native tissues,” says Ferdows Afghah, a postdoc in mechanical engineering at MIT and lead author of the study.
“If we can print tissues that more closely mimic those in our bodies, we can use them as models to understand more about human diseases, or to test the safety and efficacy of new therapeutic drugs,” adds Raman. Such models could help researchers move away from techniques like animal testing, which supports recent interest from the U.S. Food and Drug Administration in developing faster, less expensive, and more informative new approaches to establish the safety and efficacy of new treatment paths.
“Eventually, we are working towards regenerative medicine applications such as replacing diseased or injured tissues in our bodies with 3D printed tissues that can help restore healthy function,” says Raman.
MagMix, a magnetically actuated mixer, is composed of two parts: a small magnetic propeller that fits inside the syringes used by bioprinters to deposit bioinks, layer by layer, into 3D tissues, and a permanent magnet attached to a motor that moves up and down near the syringe, controlling the movement of the propeller inside. Together, this compact system can be mounted onto any standard 3D bioprinter, keeping bioinks uniformly mixed during printing without changing the bioink formulation or interfering with the printer’s normal operation. To test the approach, the team used computer simulations to design the optimal mixing propeller geometry and speed and then validated its performance experimentally.
“Across multiple bioink types, MagMix prevented cell settling for more than 45 minutes of continuous printing, reducing clogging and preserving high cell viability,” says Raman. “Importantly, we showed that mixing speeds could be adjusted to balance effective homogenization for different bioinks while inducing minimal stress on the cells. As a proof-of-concept, we demonstrated that MagMix could be used to 3D print cells that could mature into muscle tissues over the course of several days.”
By maintaining uniform cell distribution throughout long or complex print jobs, MagMix enables the fabrication of high-quality tissues with more consistent biological function. Because the device is compact, low-cost, customizable, and easily integrated into existing 3D printers, it offers a broadly accessible solution for laboratories and industries working toward reproducible engineered tissues for applications in human health including disease modeling, drug screening, and regenerative medicine.
This work was supported, in part, by the Safety, Health, and Environmental Discovery Lab (SHED) at MIT, which provides infrastructure and interdisciplinary expertise to help translate biofabrication innovations from lab-scale demonstrations to scalable, reproducible applications.
“At the SHED, we focus on accelerating the translation of innovative methods into practical tools that researchers can reliably adopt,” says Tolga Durak, the SHED’s founding director. “MagMix is a strong example of how the right combination of technical infrastructure and interdisciplinary support can move biofabrication technologies toward scalable, real-world impact.”
The SHED’s involvement reflects a broader vision of strengthening technology pathways that enhance reproducibility and accessibility across engineering and the life sciences by providing equitable access to advanced equipment and fostering cross-disciplinary collaboration.
“As the field advances toward larger-scale and more standardized systems, integrated labs like SHED are essential for building sustainable capacity,” Durak adds. “Our goal is not only to enable discovery, but to ensure that new technologies can be reliably adopted and sustained over time.”
The team is also interested in non-medical applications of engineered tissues, such as using printed muscles to power safer and more efficient “biohybrid” robots.
The researchers believe this work can improve the reliability and scalability of 3D bioprinting, making the potential impacts on the field of 3D bioprinting and on human health significant. Their paper, “Advancing Bioink Homogeneity in Extrusion 3D Bioprinting with Active In Situ Magnetic Mixing,” is available now from the journal Device.
Tech
The Physics Behind the Quadruple Axel, the Most Difficult Jump in Figure Skating
In figure skating, the quadruple axel is generally considered the most difficult jump. Until 2022, when US skater Ilia Malinin—currently riding high as the “Quad God” at the 2026 Winter Olympics—started doing them, they seemed impossible. Landing one, naturally, can give an athlete a higher score. But for skaters who aren’t generational talents like Malinin, grasping exactly how to pull off a quadruple axel can be tricky. But physics can offer some clues.
In 2024, the journal Sports Biomechanics published a study by Toin University researcher Seiji Hirosawa that brought science a little closer to understanding how quad axels work. One of the biggest factors? Getting high. Like 20 inches off the ground high.
In the current scoring system of figure skating competitions, the jury, which in the case of the Milano Cortina Games consists of two technical specialists and a technical controller, assigns a score to each technical element, namely jumps, spins, and steps. However, the scores for the more difficult jumps, such as triple or quadruple jumps, are higher than those for the other technical elements, so skaters must perform them correctly in order to win competitions.
Generally speaking the axel is the most technically complex of the jumps. There are three main types, each distinguished by their takeoffs: toe, blade, or edge. Most are named after the first person to do them; the axel is named after Norwegian skater Axel Paulsen. It is also the only one that involves a forward start, which leads the athlete to perform a half-turn more than other jumps. A simple axel, therefore, requires one and a half rotations to complete, while a quadruple axel requires four and a half rotations in the air.
To shed light on the specific kinematic strategies used by athletes to perform the quadruple axel jump, Hirosawa’s study focused on footage of two skaters who attempted this jump in competition. Using data from what’s known as the Ice Scope tracking system, researchers analyzed several parameters: vertical height, horizontal distance, and skating speed before takeoff and after landing.
Contrary to previous biomechanical studies, which suggested that jump height does not change significantly, Hirosawa’s study found that increasing jump height is crucial to successfully performing a quadruple axel jump. Both skaters, in fact, aimed to achieve significantly greater vertical heights in their attempts to perform this jump than in the triple axel.
“This suggests a strategic shift toward increasing vertical height to master 4A [quadruple axel] jumps, in contrast to previous biomechanical research that did not emphasize vertical height,” the study concluded.
Increased jump height, Hirosawa adds, provides increased flight time by allowing a large number of rotations around the longitudinal axis of the body. Short version: jump higher, turn more. “The results of this study provide valuable insights into the biomechanics of quadruple and triple axel jumps, update existing theories of figure skating research, and provide insights into training strategies for managing complex jumps,” the study concludes.
Easier said than done—unless you’re Ilia Malinin.
Tech
This GoPro and Lens Bundle Is $200 Off
If you’ve been thinking about documenting your life, whether it’s the exciting or mundane stuff, this might just be your moment. This GoPro Hero 13 Black bundle includes a variety of useful accessories, as well as a full suite of interchangeable lenses. It’s currently marked down to just $550 on Amazon, a $200 discount from its usual price.
The biggest change to this generation of GoPro action cameras is the interchangeable lens system, and this kit comes loaded with basically every lens an aspiring filmmaker could ask for. That includes the ultrawide lens mod, which boosts the field of view to 177 degrees, an anamorphic lens and filters, and a macro lens for beautiful close-up shots. While it doesn’t come with a ton of attachments, it does have a case for carrying everything, and basic adhesives to get you started.
The downside here is that GoPro is still using the same sensor and processor as previous models, for better or worse. It’s one of the highest resolution and frame rate offerings you can get, with its 27-megapixel sensor producing up to 5.3K video, and up to 120 fps, although only for five seconds at a time at the highest resolution. Unfortunately, this GoPro, like others before it, still struggles in dim lighting. That said, there are some improvements to the HDR that our reviewer Scott Gilbertson said made a big difference when it came time to start editing.
Even with an upgraded battery, the stamina can be lackluster, lasting just one or two hours depending on how warm the camera gets. Thankfully, a new pass-through charging port allows you to hook up a power bank and keep filming for much longer. There are some other quality-of-life upgrades too, like a magnetic mounting system that makes swapping from surf to sand even easier.
The Hero 13 Black is our favorite GoPro, but there’s a whole world of action cameras for your next adventure, so make sure to check out our full guide if you’re curious about other options. Otherwise, this big bundle includes everything you need to get out and start shooting for just $550.
-
Entertainment4 days agoHow a factory error in China created a viral “crying horse” Lunar New Year trend
-
Business1 week agoNew York AG issues warning around prediction markets ahead of Super Bowl
-
Tech1 week agoHow to Watch the 2026 Winter Olympics
-
Business1 week agoPost-Budget Session: Bulls Push Sensex Up By Over 900 Points, Nifty Reclaims 25,000
-
Entertainment1 week agoThe Traitors’ winner Rachel Duffy breaks heart with touching tribute to mum Anne
-
Fashion1 week agoCanada could lift GDP 7% by easing internal trade barriers
-
Business1 week agoInvestors suffer a big blow, Bitcoin price suddenly drops – SUCH TV
-
Tech1 week agoThe Best Floodlight Security Cameras for Your Home
