Connect with us

Tech

Researchers delve inside new SolarWinds RCE attack chain | Computer Weekly

Published

on

Researchers delve inside new SolarWinds RCE attack chain | Computer Weekly


Researchers at Huntress Security have published new data on exploitation of a critical SolarWinds Web Help Desk (WHD) vulnerability, revealing how in at least three known incidents, attackers conducted extensive post-exploitation activity with a common set of tools, including legitimate services such as Zoho ManageEngine and Elastic

Tracked as CVE-2025-40551, the data deserialisation vulnerability was first flagged by SolarWinds on 28 January and last week, was added to the US Cybersecurity and Infrastructure Security Agency’s (Cisa) Known Exploited Vulnerabilities (Kev) resource mandating that US government bodies fix it immediately.

“Threat actors are actively weaponising WHD vulnerabilities to achieve remote code execution [RCE] and deploy additional tooling in victim environments,” said the Huntress team.

The research team at Huntress – which protects multiple SolarWinds customers through its channel – found that having broken into their victim environments, the attackers took control of WMD’s service wrapper to spawn the underlying Java application, which enabled them to install a payload, which was in fact a Zoho ManageEngine remote monitoring and management (RMM) agent.

This done, the threat actor used the RMM agent to execute several Active Directory discovery commands to enumerate the environment. Shortly after this, they opened a Zoho Assist remote session which they used to install the open source digital forensics and incident response (DFIR) tool Velociraptor.

“While Velociraptor is designed to help defenders with endpoint monitoring and artifact collection, its capabilities, such as remote command execution, file retrieval, and process execution via VQL queries, make it equally effective as a C2 [Command and Control] framework when pointed at attacker-controlled infrastructure,” said Huntress.

In the instances its team investigated, the attackers were actually using a rather outdated version of Velociraptor that itself contained a privilege escalation flaw disclosed in 2025. Moreover, the Velociraptor server infrastructure pointed back to a known Cloudflare account associated with the Warlock ransomware operation, a possible hint to the provenance of the campaign.

Alongside Velociraptor, the threat actor also downloaded Cloudflared, the command line client for Cloudflare Tunnel, likely in order to establish a second redundant means of access.

They then proceeded to execute a PowerShall script to collect system information – data such as operating system version, hardware spec, domain membership, installed hotfixes – that was exfiltrated to a legitimate Elastic Cloud instance being run as a free trial on Elastic’s software-as-a-service (SaaS) infrastructure.

The researchers said it was somewhat ironic that the threat actor had essentially built themselves a security information and event management (SIEM) solution on Elastic’s infrastructure to triage their victims.

“Elastic’s own tooling, typically used by defenders for threat hunting and incident response, was repurposed as an attacker’s victim management dashboard,” they said.

“We have reported this malicious instance to Elastic as well as law enforcement and performed victim notification and outreach to non-Huntress partners,” said the Huntress team.

Microsoft reports on further attacks

Huntress’ full write-up of its research, available to read in full here, details various other actions taken by the threat actor during the course of their intrusions. Meanwhile, in addition to these findings, Microsoft has published details of a similar multi-stage intrusion orchestrated via SolarWinds WHD, although it has not yet been able to establish whether or not the attackers exploited CVE-2025-40551 or CVE-2025-26399 – another RCE bug disclosed in September 2025 that bypassed a previously fixed flaw that in turn bypassed a third issue first flagged in 2024.

The incident investigated by Microsoft saw the attackers use the compromised WHD instance to spawn PowerShell in order to download and execute Zoho ManageEngine to gain control of the system after which they conducted recon activity while setting up reverse secure shell (SSH) and remote desktop protocol (RDP) access to maintain their bridgehead.

Microsoft also observed the attackers creating a scheduled task to launch a QEMU virtual machine under the SYSTEM account on startup, which essentially let them hide their activity within the virtualised environment. Huntress had also noted this in some instances.

On some hosts, Microsoft said the attackers also used dynamic link library (DLL) sideloading to gain access to Local Security Authority Subsystem Service (LSASS) memory in order to steal more credentials.

Besides patching and isolating compromised hosts, Microsoft is advising its users to evict any RMM artifacts, particularly any associated with ManageEngine, that may have been added after exploitation, and immediately rotate credentials for all service and admin accounts accessible from WHD.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Salesforce Workers Circulate Open Letter Urging CEO Marc Benioff to Denounce ICE

Published

on

Salesforce Workers Circulate Open Letter Urging CEO Marc Benioff to Denounce ICE


Employees at Salesforce are circulating an internal letter to chief executive Marc Benioff calling on him to denounce recent actions by US Immigration and Customs Enforcement, prohibit the use of Salesforce software by immigration agents, and back federal legislation that would significantly reform the agency.

The letter specifically cites the “recent killings of Renee Good and Alex Pretti in Minneapolis” as catalysts, calling them the “devastating indictment of a system that has discarded human decency.” It’s unclear how many signatories the letter has received so far.

The letter, which has not been reported on previously, is being organized amid Salesforce’s annual leadership kickoff event this week in Las Vegas. During an appearance at the event earlier today, Benioff asked international employees to stand to thank them for attending. He then joked that ICE agents were in the building monitoring them, according to current and former Salesforce employees who spoke to WIRED.

Benioff’s remarks sparked immediate backlash among employees. “Lots of people are furious,” says one source, who asked to remain anonymous for fear of retaliation. Another source tells WIRED that the internal pushback today was significantly more forceful than after Benioff made other controversial comments last fall supporting President Trump’s call to deploy the National Guard to San Francisco to address crime.

Salesforce did not immediately respond to a request for comment from WIRED. Business Insider and 404 Media previously reported on Benioff’s remarks and the reaction to them inside Salesforce.

“We are deeply troubled by leaked documentation revealing that Salesforce has pitched AI technology to U.S. Immigration and Customs Enforcement to help the agency ‘expeditiously’ hire 10,000 new agents and vet tip-line reports,” the letter reads. “Providing ‘Agentforce’ infrastructure to scale a mass deportation agenda that currently detains 66,000 people—73 percent of whom have no criminal record—represents a fundamental betrayal of our commitment to the ethical use of technology.”

The letter argues that Benioff’s voice “carries unique weight in Washington,” pointing to an episode last fall when Trump called off an ICE deployment in San Francisco after what appeared to be outreach from Bay Area tech leaders, including Benioff and Nvidia CEO Jensen Huang. It urges Benioff to use that influence as a “corporate statesman” to issue a public statement condemning what it calls ICE’s unconstitutional conduct and to commit Salesforce to clear “red lines” barring the use of its cloud and AI products for state violence.

Benioff has weighed in on both national and local political issues for years. He supported Democratic presidential candidate Hillary Clinton in 2016 and later became one of the most high-profile backers of Proposition C, a failed San Francisco ballot measure that would have raised taxes to fund programs to address homelessness. In 2020, he donated to the primary campaigns of some Democratic presidential candidates, including Kamala Harris.

But since Trump returned to the White House in January, Benioff has signaled greater support for some Republican leaders. In one interview, he said he strives to stay nonpartisan because he also owns Time magazine. But he also joked that, while he declined to contribute to Trump’s inauguration fund directly, he had “donated” a photo of the president on the magazine’s cover, which named him its 2024 Person of the Year. “He can use the Time magazine cover for free,” Benioff said in the interview with Fortune.

Benioff also faced backlash from Salesforce employees last fall when he suggested the National Guard should be sent to San Francisco to tackle crime ahead of the company’s annual conference in the city. He later apologized for the remarks, explaining they stemmed from genuine concerns about safety. He later reversed his stance and joined Nvidia’s Huang in asking Trump to refrain from sending troops.



Source link

Continue Reading

Tech

Magnetic mixer improves 3D bioprinting

Published

on

Magnetic mixer improves 3D bioprinting



3D bioprinting, in which living tissues are printed with cells mixed into soft hydrogels, or “bio-inks,” is widely used in the field of bioengineering for modeling or replacing the tissues in our bodies. The print quality and reproducibility of tissues, however, can face challenges. One of the most significant challenges is created simply by gravity — cells naturally sink to the bottom of the bioink-extruding printer syringe because the cells are heavier than the hydrogel around them.

“This cell settling, which becomes worse during the long print sessions required to print large tissues, leads to clogged nozzles, uneven cell distribution, and inconsistencies between printed tissues,” explains Ritu Raman, the Eugene Bell Career Development Professor of Tissue Engineering and assistant professor of mechanical engineering at MIT. “Existing solutions, such as manually stirring bioinks before loading them into the printer, or using passive mixers, cannot maintain uniformity once printing begins.”

In a study published Feb. 2 in the journal Device, Raman’s team introduces a new approach that aims to solve this core limitation by actively preventing cell sedimentation within bioinks during printing, allowing for more reliable and biologically consistent 3D printed tissues.

“Precise control over the bioink’s physical and biological properties is essential for recreating the structure and function of native tissues,” says Ferdows Afghah, a postdoc in mechanical engineering at MIT and lead author of the study.

“If we can print tissues that more closely mimic those in our bodies, we can use them as models to understand more about human diseases, or to test the safety and efficacy of new therapeutic drugs,” adds Raman. Such models could help researchers move away from techniques like animal testing, which supports recent interest from the U.S. Food and Drug Administration in developing faster, less expensive, and more informative new approaches to establish the safety and efficacy of new treatment paths.

“Eventually, we are working towards regenerative medicine applications such as replacing diseased or injured tissues in our bodies with 3D printed tissues that can help restore healthy function,” says Raman.

MagMix, a magnetically actuated mixer, is composed of two parts: a small magnetic propeller that fits inside the syringes used by bioprinters to deposit bioinks, layer by layer, into 3D tissues, and a permanent magnet attached to a motor that moves up and down near the syringe, controlling the movement of the propeller inside. Together, this compact system can be mounted onto any standard 3D bioprinter, keeping bioinks uniformly mixed during printing without changing the bioink formulation or interfering with the printer’s normal operation. To test the approach, the team used computer simulations to design the optimal mixing propeller geometry and speed and then validated its performance experimentally.

“Across multiple bioink types, MagMix prevented cell settling for more than 45 minutes of continuous printing, reducing clogging and preserving high cell viability,” says Raman. “Importantly, we showed that mixing speeds could be adjusted to balance effective homogenization for different bioinks while inducing minimal stress on the cells. As a proof-of-concept, we demonstrated that MagMix could be used to 3D print cells that could mature into muscle tissues over the course of several days.”

By maintaining uniform cell distribution throughout long or complex print jobs, MagMix enables the fabrication of high-quality tissues with more consistent biological function. Because the device is compact, low-cost, customizable, and easily integrated into existing 3D printers, it offers a broadly accessible solution for laboratories and industries working toward reproducible engineered tissues for applications in human health including disease modeling, drug screening, and regenerative medicine.

This work was supported, in part, by the Safety, Health, and Environmental Discovery Lab (SHED) at MIT, which provides infrastructure and interdisciplinary expertise to help translate biofabrication innovations from lab-scale demonstrations to scalable, reproducible applications.

“At the SHED, we focus on accelerating the translation of innovative methods into practical tools that researchers can reliably adopt,” says Tolga Durak, the SHED’s founding director. “MagMix is a strong example of how the right combination of technical infrastructure and interdisciplinary support can move biofabrication technologies toward scalable, real-world impact.”

The SHED’s involvement reflects a broader vision of strengthening technology pathways that enhance reproducibility and accessibility across engineering and the life sciences by providing equitable access to advanced equipment and fostering cross-disciplinary collaboration.

“As the field advances toward larger-scale and more standardized systems, integrated labs like SHED are essential for building sustainable capacity,” Durak adds. “Our goal is not only to enable discovery, but to ensure that new technologies can be reliably adopted and sustained over time.”

The team is also interested in non-medical applications of engineered tissues, such as using printed muscles to power safer and more efficient “biohybrid” robots.

The researchers believe this work can improve the reliability and scalability of 3D bioprinting, making the potential impacts on the field of 3D bioprinting and on human health significant. Their paper, “Advancing Bioink Homogeneity in Extrusion 3D Bioprinting with Active In Situ Magnetic Mixing,” is available now from the journal Device



Source link

Continue Reading

Tech

The Physics Behind the Quadruple Axel, the Most Difficult Jump in Figure Skating

Published

on

The Physics Behind the Quadruple Axel, the Most Difficult Jump in Figure Skating


In figure skating, the quadruple axel is generally considered the most difficult jump. Until 2022, when US skater Ilia Malinin—currently riding high as the “Quad God” at the 2026 Winter Olympics—started doing them, they seemed impossible. Landing one, naturally, can give an athlete a higher score. But for skaters who aren’t generational talents like Malinin, grasping exactly how to pull off a quadruple axel can be tricky. But physics can offer some clues.

In 2024, the journal Sports Biomechanics published a study by Toin University researcher Seiji Hirosawa that brought science a little closer to understanding how quad axels work. One of the biggest factors? Getting high. Like 20 inches off the ground high.

In the current scoring system of figure skating competitions, the jury, which in the case of the Milano Cortina Games consists of two technical specialists and a technical controller, assigns a score to each technical element, namely jumps, spins, and steps. However, the scores for the more difficult jumps, such as triple or quadruple jumps, are higher than those for the other technical elements, so skaters must perform them correctly in order to win competitions.

Generally speaking the axel is the most technically complex of the jumps. There are three main types, each distinguished by their takeoffs: toe, blade, or edge. Most are named after the first person to do them; the axel is named after Norwegian skater Axel Paulsen. It is also the only one that involves a forward start, which leads the athlete to perform a half-turn more than other jumps. A simple axel, therefore, requires one and a half rotations to complete, while a quadruple axel requires four and a half rotations in the air.

To shed light on the specific kinematic strategies used by athletes to perform the quadruple axel jump, Hirosawa’s study focused on footage of two skaters who attempted this jump in competition. Using data from what’s known as the Ice Scope tracking system, researchers analyzed several parameters: vertical height, horizontal distance, and skating speed before takeoff and after landing.

Contrary to previous biomechanical studies, which suggested that jump height does not change significantly, Hirosawa’s study found that increasing jump height is crucial to successfully performing a quadruple axel jump. Both skaters, in fact, aimed to achieve significantly greater vertical heights in their attempts to perform this jump than in the triple axel.

“This suggests a strategic shift toward increasing vertical height to master 4A [quadruple axel] jumps, in contrast to previous biomechanical research that did not emphasize vertical height,” the study concluded.

Increased jump height, Hirosawa adds, provides increased flight time by allowing a large number of rotations around the longitudinal axis of the body. Short version: jump higher, turn more. “The results of this study provide valuable insights into the biomechanics of quadruple and triple axel jumps, update existing theories of figure skating research, and provide insights into training strategies for managing complex jumps,” the study concludes.

Easier said than done—unless you’re Ilia Malinin.



Source link

Continue Reading

Trending