Full Report
A deep dive into a threat actor who exploited SolarWinds Web Help Desk, abused an Elastic Cloud SIEM free trial for exfiltration and triage, revealing key infrastructure.
Analysis Summary
# Threat Actor: [Unnamed/Opportunistic Adversary]
## Attribution & Identity
* **Actor Identification:** Currently unidentified opportunistic threat actor.
* **Aliases/Associated Groups:** No formal alias assigned yet; however, the actor shows overlap with campaigns targeting Microsoft SharePoint and other enterprise software vulnerabilities.
* **Known Associations:** Linked to the use of Russian-registered temporary email infrastructure (**firstmail[.]ltd**) and disposable email domains (**quieresmail[.]com**).
## Activity Summary
The actor was observed in early 2026 conducting a campaign that exploited **SolarWinds Web Help Desk** (CVE-2025-26399). A unique aspect of this operation was the abuse of a **free trial of Elastic Cloud SIEM** to serve as a command-and-control (C2) and data triage platform. The actor exfiltrated system metadata from multiple victims into this centralized, legitimate cloud infrastructure to organize their post-exploitation efforts.
## Tactics, Techniques & Procedures
* **Exploitation:** Leverages vulnerabilities in web-facing applications, specifically SolarWinds Web Help Desk.
* **Discovery:** Uses PowerShell (specifically the `Get-ComputerInfo` cmdlet) to gather OS versions, hardware details, Active Directory domain information, and patch levels. [T1082]
* **Exfiltration to Cloud:** Uses encoded PowerShell commands to push stolen data directly to an Elasticsearch index via API. [T1567]
* **Defense Evasion:**
* Uses legitimate security software (Elastic Cloud) to blend in with normal network traffic.
* Employs **SAFING_VPN** tunnels to mask the origin of their administrative activity.
* Uses encoded commands to bypass basic string-based detection. [T1027]
* **Infrastructure Management:** Registration of trial accounts using disposable email services to maintain anonymity.
## Targeting
* **Sectors:** Opportunistic; targeting organizations running vulnerable versions of SolarWinds Web Help Desk and potentially Microsoft SharePoint.
* **Geography:** Global (infrastructure noted in GCP's `us-central1` region).
* **Victims:** Multiple organizations (implied by the "systeminfo" index containing data from various sources).
## Tools & Infrastructure
* **Malware/Scripts:** Custom encoded PowerShell exfiltration scripts.
* **Infrastructure:**
* **Elastic Cloud SIEM:** Used for exfiltration and victim triage (Instance ID: `7c00a38569a8471083b6b34e1511b9de`).
* **VPN:** SAFING_VPN.
* **Domains:**
* quieresmail[.]com (Disposable email)
* firstmail[.]ltd (Russian-registered temp mail provider)
* **Elasticsearch Version:** 9.2.4
## Implications
This campaign highlights a growing trend of "Living off the Cloud" (LotC), where attackers leverage free trials of legitimate security and logging platforms (SIEMs) to facilitate their operations. By using legitimate cloud endpoints, attackers can bypass traditional firewall rules that might block known malicious C2 IPs, as the traffic appears to be destined for trusted providers like Elastic or GCP.
## Mitigations
* **Vulnerability Management:** Prioritize patching of SolarWinds Web Help Desk (CVE-2025-26399) and SharePoint instances.
* **Egress Monitoring:** Monitor for unexpected PowerShell traffic communicating with cloud-based logging or SIEM endpoints (e.g., `*.elastic-cloud.com` or GCP IPs) if your organization does not legitimately use those services.
* **PowerShell Logging:** Enable Script Block Logging (ID 4104) to decode and inspect obfuscated commands targeting system metadata.
* **API Monitoring:** Audit the use of hardcoded API keys in environment scripts and block outbound connections to unauthorized data repositories.