
- Hackers exploit SolarWinds Web Help Desk flaws CVE-2025-40551 and CVE-2025-26399
- Attackers deploy Zoho ManageEngine, Cloudflare tunnels, Velociraptor for persistence and control
- Campaign ongoing since January, disabling security tools before deploying additional malware