When Trusted Tools Turn Hostile: A Series of N-able Zero-Days Enables Multiple Threat Actors to Pre-Position Ransomware

Executive Summary

CyberMaxx Threat Response Team observed threat actors abusing 0-day exploits in N-able N-central to gain unauthorized access to victim environments for impact. N-able N-central is a Remote Monitoring and Management (RMM) software which allows administrators to manage their environments at scale. This makes RMM tools highly attractive targets for attackers since gaining access means they have pre-built enumeration and deployment methods which look like normal administrative activity.  

N-able has suffered no less than five back-to-back 0-days exploited in the past 6 weeks by threat actors. In the outlined events, CyberMaxx observed legitimate N-able N-central capabilities being abused by adversaries to automate attacks which rapidly executed reconnaissance, deployed SimpleHelp (a secondary remote-access tool) for persistence and lateral movement, attempted data theft and pre-positioned themselves for ransomware deployment.  

CyberMaxx Threat Intelligence assesses with a high degree of confidence this activity can be attributed to a cluster known dubbed “Storm-1175” by Microsoft Threat Intelligence.  

TL; DR:

• N-able 0-days abused for initial access 

• Suspicious binaries delivered through N-able 

• SimpleHelp RMM Installed 

• Legitimate administrator passwords altered 

• Cloudflared installed on beachhead 

• Exfiltration attempted through the tunnel 

• StormEncryptor positioned for ransomware deployment 

CVE Madness

Starting on August 1, N-able disclosed 5 critical vulnerabilities in their N-central product.  

All of which are severe and exploited in the wild. The first wave of exploitation (CVE-2026-18556) was an authentication bypass which enabled attackers to abuse the built-in “Take Control” feature to gain access to all endpoints managed by the software. The initial fix was incomplete and introduced alternative methods to bypass authentication. Thus, a second CVE (CVE-2026-185771) was issued and N-able issued their Hotfix 1, attempting to patch both vulnerabilities on August 2. 

In somewhat murky details on August 6, N-able released Hotfix 2, intended to supersede Hotfix 1. Meanwhile, reports of N-able abuse still trickled in. 

On September 5, Huntress reported that a new exploit chain (separate from the previously reported CVE’s) was being abused in the wild. Additionally, the chain was able to bypass patches made in Hotfix 2. In coordination with N-able, Hotfix 3 was released the same day to patch the two new CVE’s (CVE-2026-86206 and CVE-2026-86207).  

Most recently, on September 6, CVE-2026-86218 was disclosed as a pre-authentication remote code execution vulnerability with a CVSS score of 10. It was published by an independent researcher who confirmed it was exploited in the wild. N-able in coordination with the researcher published Hotfix 4, the most recent patches meant to supersede the prior 3.   

Stormin Through the Front Door!

In the cases laid out below, we identify similarities from an attacker who follows a playbook to achieve actions on objectives across multiple environments. Microsoft has clustered a threat group called “Storm-1175”.  This isn’t a specific group, rather a subset of likely China-based threat actors collected by the tools they use. Based off a pattern of opportunistic behavior, the binaries pre-positioned for ransomware deployment, and the vulnerability exploited, we assess with a high degree of confidence that Storm-1175 is the threat actor in the cases we’ll be talking about below.  

Two Events, One Playbook

Over the course of the N-able CVE disclosures CyberMaxx has reacted to multiple events abusing the vulnerabilities laid out above. These follow the Storm playbook by gaining access through an unpatched N-day, modifying the target environment, deploying communications tunnels, installing additional RMM tools, gathering sensitive data, and prepositioning ransomware.  

Event A

INITIAL ACCESS 

Initial events show, NableReactiveManagement.exe transferred MicrosoftEdgeUpdate64.exe N-able managed endpoints. This is a Cloudflare executable masquerading as a Microsoft Edge update. The purpose is establishing encrypted channels for communication to the control server (C2), exfiltration, and serving as a gateway past the environments firewall with the following commands.  

Additionally, Net.exe is observed issuing commands to alter an administrative user’s password to “Pass123qwe!@#QWE”. 

ENUMERATION

N-able Command Prompt Manager issued the systeminfo command through cmd.exe. Then the threat actor deposited TreeSizeFree.exe on the system. TreeSize is used to enumerate sensitive data, SMB shares, and for evasion because the application was created as an administrative tool for disk space analysis. In this case, it does exactly that while attempting to blend into the environment. In addition, 7-Zip can be observed manipulating the file system likely in preparation for an exfiltration attempt.  

PERSISTENCE & LATERAL MOVEMENT

A secondary remote-access mechanism was observed after establishing Cloudflare tunnels: SimpleHelp Remote Access.  

NableReactiveManagement.exe writes C:\Temp\serviceoffudp.exe and issues the following commands:

MicrosoftEdgeUpdate64.exe service install
C:\ProgramData\Microsoft\MicrosoftEdgeUpdate64.exe tunnel run --token-file C:\ProgramData\cloudflared\token

Which silently installs SimpleHelp Remote access management.  

Adding a second RMM at this point ensures access to the environment through the Cloudflare tunnels in the event the initial access vector is remediated. SimpleHelp is then deployed in conjunction with established Cloudflare Tunnels as an internal pivot to reach a file server over SMB, RDP, and HTTP.  

During an attacker-controlled RDP session on the file server, Chrome communicated with Filemail-associated infrastructure.  

Event B

INITIAL ACCESS

Initial access is gained through recent N-able 0-day exploits. Telemetry shows the attacker using N-able (TCRmtShellAgent.exe ) to issue commands against a domain controller. The following enumeration was observed immediately:

quser
net group "domain admins" /domain
net user [mistyped account]
net user
net user

At this point, an administrative account has their password changed to a string matching that of Event A: “Pass123qwe!@#QWE” and they open an interactive session to a domain controller.  

ENUMERATION, PERSISTENCE, and LATERAL MOVEMENT

At this stage SimpleHelp was installed through the same method as Event A. A binary named service64off.exe is deposited on the host with a hash that matches: 5c58e03a2573b1ebf901f365f8450204e6d6da63. Soon after altering the administrative password, an RDP session was opened to an additional server with those credentials where staging would occur. The attacker went hands on keyboard opening powershell_ise.exe to import a PowerShell module, Mount.ps1. Ultimately, this enumerated SMB, built a local symbolic-link tree pointing to reachable UNC shares, and staged a toolkit that included PCManager.zip and HNOs2Ec.sys.   

Recommendations  

N-able has released Hotfix 4, which supersedes all prior hotfixes — systems running Hotfix 2 or Hotfix 3 remain fully vulnerable to CVE-2026-86218 (a new zero-day exploit). CyberMaxx strongly urges on-premise N-central deployments to apply Hotfix 4 immediately, outside of normal patch cycles; hosted (NCOD) instances have already been patched by N-able. 

If you are concerned about potential compromise, contact the CyberMaxx SOC and audit all user accounts for unauthorized creation or password changes. Likewise, review “Take Control” session logs and API access logs for unrecognized activity. 

Lastly, if N-able servers must remain exposed, restrict all inbound access to the N-central console behind VPN or strict IP allowlisting. 

Detection Opportunities

Defenders should baseline normal RMM administration and detect unusual relationships between trusted parent processes and downstream actions.  

The following behaviors provided the strongest signal across N-able exploitation: 

RMM-to-RMM deployment: N-able writing or launching SimpleHelp, AnyDesk, ScreenConnect, RustDesk, or any other remote-access product that is not part of the approved administrative stack. 

RMM-to-tunnel execution: N-able remote-command or file-transfer components introducing Cloudflare Tunnel or other proxy/tunneling utilities. 

Administrative Account modification followed by interactive access: A remote-management shell changing a privileged user’s password and seeing that identity establish a new interactive session shortly afterward. 

EDR based detections should look for the following initial access techniques from the exploit chain:  

ParentProcess (TCRmtShellAgent.exe|NableCommandPromptManager64.exe) spawning cmd.exe 

Likewise, at lateral movement: 

ParentProcess (BASupSrvc.exe|NableReactiveManagement.exe) AND ChildFileHash matching that of CloudFlare binaries 

Conclusion

The tools organizations trust to manage their environments are the same tools adversaries value. RMM platforms offer broad access and implicit trust — when compromised, attackers inherit a deployment pipeline that looks like normal administration. 

What makes this campaign stand out is the velocity. Four zero-days in six weeks, each undermining the patch before it, gave Storm-1175 a sustained window to execute a repeatable playbook: exploit the RMM, install a backup RMM, tunnel out, alter credentials, stage ransomware. 

CyberMaxx Threat Intelligence and Threat Response Team continues to actively monitor for indicators tied to this campaign. Organizations running on-premise N-central should treat Hotfix 4 as an emergency action, and audit administrative accounts, session logs, and any newly introduced remote-access tooling.

MITRE ATT&CK Techniques

IOC

References

– https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/

– https://guides.simple-help.com/kb—silently-install-or-uninstall-the-remote-access-service#silently-manage-the-remote-access-service)