Attackers who broke into an N-able N-central server used it to push six different remote-access programs onto machines across the victim's network, then hid a Cloudflare tunnel under a Microsoft file name to keep their way back in. Sophos Counter Threat Unit researchers published the intrusion on August 4, the first detailed account of what exploitation of this flaw actually looks like from the inside.
The way in was CVE-2026-18577, the authentication bypass in N-able's remote monitoring and management platform that CISA added to its Known Exploited Vulnerabilities catalog on August 3. IntelFusions covered the advisory and the hotfix at the time. N-able has since said exploitation began on July 31 as a zero-day, and an incomplete fix for an earlier bypass, CVE-2026-18556, has been reported as the underlying cause, though N-able has not directly confirmed that.
How widespread is it
Narrower than the alarm around it suggests, on the evidence so far. Sophos identified a single compromised organisation in its customer telemetry and says it has observed no evidence that compromises are widespread. That is one vendor's view of its own customers rather than a survey of the internet, but it is the first figure anyone has attached to the exploitation. The victim was compromised at approximately 08:00 UTC on August 3, two days after exploitation began.
What the attacker did inside
Administrative control of the N-central console brings remote control of the endpoints it manages, and the intruder used it to reach a backup server, domain controllers and application servers. They created a new domain account named veeam, borrowing the name of a widely used backup product so it would not stand out in a list, and reset the passwords of several existing domain administrator accounts. Reconnaissance was routine: net user commands to enumerate accounts, nltest /dclist: to list domain controllers, and net group "domain admins" /domain.
Then came the tool sprawl. AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk were all deployed to reachable endpoints. Piling on legitimate remote-access software is a deliberate tactic, and one we have seen show up repeatedly in incident response data: each product is something some administrator somewhere genuinely uses, so no single install looks obviously wrong, and pulling one out still leaves five. Cloudflare Tunnel was installed on several hosts and renamed MicrosoftEdgeUpdate64.exe or msmp.exe to masquerade as a benign Microsoft component, giving persistent remote access that needs no inbound firewall rule.
To find the security products in the way, the attacker ran tasklist and piped the output through findstr ms and findstr soph, checking for Microsoft Defender and Sophos agents respectively. Where one turned up, an endpoint detection and response evasion tool called PhantomKiller loaded a driver named k.sys from C:\ProgramData\AnyDesk. In one instance PhantomKiller, running as 9.exe, terminated the Sophos File Scanner process outright.
One piece of vendor guidance needs a caveat. N-able told administrators that a file named svchost.exe in a user's Documents folder can reveal that a system has been compromised, but Sophos did not observe that filename in the affected environment. Sophos suggests svchost.exe may simply be one of the legitimate Windows names the attackers use to disguise cloudflared, so hunt the behaviour rather than that one filename.
What you should do
Apply the N-central hotfix now if it is not already in, then go looking rather than assuming the patch closed the story. Search for remote-access agents nobody procured, for tunnelling software wearing a Microsoft name, for domain accounts created in the past week and for administrator password resets nobody requested. Sophos's countermeasure for the evasion tooling is CXmal/KillAV-BR. The Counter Threat Unit Research Team's full write-up carries the complete indicator table.
Indicators
Sophos lists ten IP addresses used to identify and exploit the flaw, defanged here: 173[.]249[.]252[.]200, 172[.]249[.]252[.]176, 87[.]249[.]138[.]34, 37[.]19[.]210[.]32, 68[.]235[.]46[.]214, 68[.]235[.]46[.]235, 37[.]153[.]90[.]88, 92[.]118[.]112[.]181, 23[.]234[.]94[.]43 and 185[.]156[.]46[.]150. Two of those, 87[.]249[.]138[.]34 and 37[.]19[.]210[.]32, are suspected NordVPN and Mullvad egress nodes respectively and will carry unrelated traffic, so treat them accordingly. The command and control domains used by the deployed remote-access tools were who-ripped-one[.]direct[.]quickconnect[.]to, mousears[.]synology[.]me and wagoosh[.]direct[.]quickconnect[.]to, with api[.]mendoratech[.]health serving as the TacticalRMM server. IP addresses get reallocated, so age your hunting accordingly.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.