SolarWinds Vulnerability Exploited in First Stage of Clop Ransomware Attacks

Russian cybercrime group known as T505 is targeting SolarWinds Server-U systems that havent been patched for a remote code execution vulnerability fixed this summer.

A recent surge in Clop ransomware attacks led researchers to spot a common thread in the first stage of the attack: the exploitation of a known and patched vulnerability in SolarWinds Serv-U file server software.
NCC Groups Cyber Incident Response Team recently spotted the attack chain while conducting incident response cases of Clop ransomware victims hit by the infamous T505 cybercrime group out of Russia.
We believe exploiting such vulnerabilities is a recent initial access technique for TA505, deviating from the actor’s usual phishing-based approach, the researchers wrote in their findings.
The attackers exploited versions of the SolarWinds Serv-U software that have not been updated to the latest version that fixes the remote code execution flaw (CVE-2021-35211).
NCC Group recommends updating SolarWinds Serv-U software to the newest version; it outlined several indicators of compromise they spotted in the attacks.
Read the full report
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
SolarWinds Vulnerability Exploited in First Stage of Clop Ransomware Attacks