N-able has issued Hotfix 2 for its N-central platform in response to an actively exploited zero-day vulnerability. The company confirmed that attackers leveraged this flaw to achieve administrative access on managed systems and establish persistence. This activity prompted the release of the hotfix, alongside additional guidance for affected customers.
The reported attack chain involved the exploitation of a previously unknown vulnerability within the N-central platform. This zero-day flaw allowed malicious actors to escalate privileges and gain administrative control over the N-central deployment. Such access to a remote monitoring and management (RMM) platform is particularly critical, as it provides a gateway to all endpoints and servers managed by that system.
A key aspect of the observed attacks was the establishment of persistence. Attackers reportedly utilized Cloudflare Tunnel to maintain access to compromised systems. Cloudflare Tunnel is a service designed to securely connect applications and services to the internet without opening inbound firewall ports. In this context, its use by attackers would allow them to create persistent, outbound-initiated connections from the compromised N-central environment to their command-and-control infrastructure, making detection and remediation more challenging.
The N-able N-central platform is a widely used RMM solution, primarily by managed service providers (MSPs) to oversee and manage their clients' IT infrastructure. A compromise of an RMM platform can therefore have a significant ripple effect, potentially exposing numerous client environments to further attack. The company has indicated that a limited number of customers were affected by this specific campaign.
Mitigation for this class of vulnerability typically involves applying vendor-supplied patches or hotfixes as soon as they become available. For RMM platforms, it is also crucial to implement robust access controls, including multi-factor authentication for all administrative accounts, and to segment the RMM infrastructure from other critical internal systems. Regular auditing of logs for unusual activity, particularly outbound connections or new user creations, is also recommended.
N-able is providing additional indicators of compromise (IoCs) and tools to assist customers in detecting and responding to potential breaches. This incident underscores the ongoing threat posed by zero-day vulnerabilities, particularly in critical infrastructure management tools like RMM platforms, which can serve as a pivot point for broader attacks across an organization's or an MSP's client base.
