2026-08-05 · view entry permalink →
N-able N-central post-exploitation, unpacked: six remote-access tools pushed to managed endpoints, a Cloudflare tunnel renamed as a Microsoft updater, and an EDR-evasion driver staged from a remote-support directory
UPDATE · originally covered CVE-2026-18556 / CVE-2026-18577 — N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable (2026-08-03)
Two developments turn the N-able N-central authentication bypass from a patching task into a compromise-assessment task. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on 2026-08-04, based on evidence of active exploitation (CISA, 2026-08-04). More usefully, Sophos X-Ops has published what the actor did after taking the console (Sophos X-Ops, 2026-08-04) — the original coverage described the flaw and the incomplete first fix, but not the post-exploitation chain, and that chain is what determines whether the hotfix was sufficient.
On the management server itself, the actor created a new domain account under a backup-product name, reset existing administrator credentials, and enumerated accounts, domain-administrator group membership and installed security products before moving on (Sophos X-Ops, 2026-08-04). The reconnaissance is unremarkable; the account creation and credential reset are not, because they survive the platform being patched.
The console was then used as a distribution channel. Sophos records six different remote-monitoring-and-management tools pushed from the compromised N-central console onto reachable endpoints — AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk — establishing remote access that no longer depends on N-central at all (Sophos X-Ops, 2026-08-04). That is the structural point for anyone who patched and moved on: the entry point was closed, and six independent ways back in were already in place. Alongside them a Cloudflare Tunnel client was deployed and renamed to a Microsoft-update-styled filename, giving persistent outbound tunnelling that blends into ordinary update traffic by name, and a kernel driver Sophos names PhantomKiller was loaded from a remote-support tool's ProgramData directory as an endpoint-detection-evasion component — in one instance terminating the endpoint vendor's own file-scanner process. The actor then used the management server to reach a backup server, domain controllers and application servers directly (Sophos X-Ops, 2026-08-04) — an RMM platform's whole value is reach, and that reach transfers to whoever holds the console.
Hunt concepts, telemetry class first. In account-management telemetry, local and domain account creation events sourced from the N-central service-account context are the first artefact. In process-creation telemetry with parent lineage, account-enumeration and domain-trust utilities invoked by the N-central server process rather than by an interactive administrator session is a lineage anomaly no legitimate workflow produces. In software-inventory telemetry, the presence of any remote-monitoring agent an endpoint was never provisioned with is high-fidelity regardless of which product it is. In binary-integrity telemetry, a process whose filename claims a Microsoft update component but whose signature and hash do not match that publisher is the renamed tunnel client. In driver-load telemetry, a newly loaded kernel driver staged under a remote-access tool's data directory is the evasion component.
Triage: managed-service estates legitimately run remote-access tooling, and a second product can appear during a genuine tooling migration — the discriminators are whether the deployment correlates with a change record, whether it arrived through the console at a time no administrator was working, and whether the same push reached hosts outside the migration's scope. A signed remote-access binary is not itself suspicious; a signed remote-access binary that nobody in IT deployed is.
the threat actor used the compromised N-central server to access high-value endpoints such as a backup server, domain controllers, and application servers
the PhantomKiller endpoint detection and response (EDR) evasion tool loaded a driver named k.sys, which was located in C:\\ProgramData\\AnyDesk
based on evidence of active exploitation