N-able has issued a second wave of hotfixes for its N-central Remote Monitoring and Management (RMM) platform as part of an ongoing investigation into active exploitation. This is not a re-release of the earlier fix — the company has explicitly stated it is "proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques."
That sentence should alarm every MSP and every security team operating downstream of one. When a vendor ships additional hotfixes against a live campaign, it means the initial fix didn't close the full attack surface — and adversaries adapted faster than the patch cycle. More critically, N-able's language confirms what we feared from the outset: attackers have moved beyond the RMM server itself and are now reaching managed endpoints and establishing persistence.
If you operate N-central — on-premises or hosted — or you consume services from an MSP that does, you are in scope. RMM platforms are the highest-leverage compromise target in the modern threat landscape: one breached console equals remote code execution on every managed endpoint under it. We saw this pattern with Kaseya VSA (REvil, 2021) and ConnectWise ScreenConnect; the N-central campaign follows the same strategic logic, and the defensive response must assume the worst.
Technical Analysis
Affected Platform
- Product: N-able N-central (Remote Monitoring and Management platform)
- Deployment models: On-premises N-central servers are the primary concern — these are the instances where hotfixes must be manually applied and where organizations control patch cadence. N-able-hosted environments are patched by the vendor but downstream endpoints still require auditing.
- Blast radius: Every endpoint enrolled under the N-central instance — typically entire customer fleets for MSP deployments, meaning a single compromised N-central server can translate into hundreds or thousands of downstream victims across multiple organizations.
No CVE Has Been Publicly Assigned — Do Not Wait for One
As of this writing, N-able has not published a CVE identifier for this issue in its public communications. That is not a reason to deprioritize. Vendors frequently withhold CVE assignment during active investigations to avoid accelerating adversary adaptation. Operationally, treat this as a known-exploited RMM vulnerability with confirmed in-the-wild activity and act accordingly. When the CVE lands, you want remediation already done — not queued.
How the Attack Works (Defender's View of the Chain)
Based on N-able's disclosures and the confirmed behavior of threat actors evolving techniques between hotfixes, the attack chain follows the classic RMM-compromise playbook:
- Initial access to the N-central server. Exploitation of the disclosed flaw against internet-facing or reachable N-central infrastructure (typically the web/console component). N-central's management interface must be reachable by agents; if yours is exposed to the broader internet, your exposure is immediate.
- Abuse of legitimate RMM functionality. Once inside, attackers don't need malware — they inherit the platform's god-mode capabilities: remote script execution, software push, file transfer, and shell access to every enrolled agent. This is living-off-the-RMM: malicious activity wrapped in digitally signed, vendor-expected tooling that sails past most application control.
- Push to managed endpoints. Attacker-crafted scripts or payloads are dispatched through the N-central agent framework to managed systems. The agent service executes them with SYSTEM-level privileges.
- Persistence. N-able's warning that actors are persisting is the critical detail. Expect persistence at both layers: rogue accounts or API tokens on the N-central console, and classic endpoint persistence (services, scheduled tasks, Run keys, new local admin accounts) on managed systems — designed to survive even after the N-central server is patched and remediated.
Exploitation Status
- Confirmed active exploitation: Yes — N-able's own language ("ongoing monitoring of threat actors," "attackers reach managed systems and persist") constitutes vendor-confirmed in-the-wild activity.
- Technique evolution post-patch: Confirmed — the second hotfix round exists specifically because attackers adapted.
- CISA KEV: Monitor the CISA Known Exploited Vulnerabilities catalog for an entry once a CVE is assigned; RMM vulnerabilities with confirmed exploitation are strong KEV candidates.
Detection & Response
The single most important mindset shift: your EDR telemetry on managed endpoints is the ground truth. Even if the N-central server logs are thin, the agent-side execution trail — child processes, dropped files, persistence writes — is visible. Hunt it.
Sigma Rules
These three rules target the highest-fidelity behaviors of RMM-abuse post-compromise: the N-central agent stack spawning shells, persistence registration immediately following agent execution, and outbound connections from the agent to unusual infrastructure.
---
title: N-central Agent Spawning Command Shell or Scripting Engine
id: 4f8c2e91-7b3a-4d5e-9c1f-2a6b8d0e3f47
status: experimental
description: Detects the N-able N-central agent or related RMM processes spawning cmd.exe, powershell.exe, wscript, or rundll32 — consistent with threat actors pushing scripts through compromised RMM infrastructure to managed endpoints.
references:
- https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/08/05
tags:
- attack.execution
- attack.t1059
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\N-able\'
- '\Ncentral\'
- '\N-able Technologies\'
ParentImage|endswith:
- '\AgentMaintenance.exe'
- '\winagent.exe'
- '\BASupSrvc.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\mshta.exe'
filter_known_admin:
CommandLine|contains:
- 'N-central'
- 'agent maintenance'
condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate MSP automation scripts pushed via N-central — baseline your MSP's scheduled tasks and maintenance windows; investigate any execution outside them
level: high
---
title: Persistence Registration Following N-central Agent Activity
id: 8d1e6a42-3f7b-4c9d-b2e5-9a4c7f1d8e23
status: experimental
description: Detects creation of Windows services or Run-key persistence by processes associated with the N-central agent stack, a technique used to survive RMM server remediation after compromise.
references:
- https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html
- https://attack.mitre.org/techniques/T1543/003/
- https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/08/05
tags:
- attack.persistence
- attack.t1543.003
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection_runkey:
TargetObject|contains:
- '\CurrentVersion\Run'
- '\CurrentVersion\RunOnce'
- '\Services\'
selection_actor:
Image|contains:
- '\N-able\'
- '\Ncentral\'
- '\Temp\'
- '\ProgramData\'
filter_rmm_binaries:
Details|contains:
- 'N-able'
- 'Ncentral'
- 'SolarWinds'
condition: selection_runkey and selection_actor and not filter_rmm_binaries
falsepositives:
- Software deployment tasks pushed by the MSP — validate against change tickets
level: high
---
title: Scheduled Task Created by N-central Agent Process
id: 2b9f4d17-6e8a-4c3b-a1d9-5f2e8c7b4a96
status: experimental
description: Detects schtasks or PowerShell scheduled-task registration spawned from the N-central agent process tree, indicating persistence establishment on managed endpoints following RMM compromise.
references:
- https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html
- https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/08/05
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\N-able\'
- '\Ncentral\'
selection_cmd:
CommandLine|contains:
- 'schtasks'
- 'Register-ScheduledTask'
- 'New-ScheduledTask'
- '/create'
condition: selection_parent and selection_cmd
falsepositives:
- MSP-configured maintenance task deployment — correlate with N-central job history
level: medium
KQL — Microsoft Sentinel / Defender Hunt
This query hunts across Defender endpoint telemetry for execution chains originating from the N-central agent stack and correlates them with persistence artifacts and network connections — the three observable layers of this campaign.
// Hunt: N-central agent execution chains with persistence and network correlation
// Lookback tuned to campaign window — extend as your N-central patch timeline requires
let Lookback = 14d;
let AgentPath = dynamic([@"N-able", @"Ncentral", @"winagent", @"AgentMaintenance", @"BASupSrvc"]);
let SuspiciousChildren = dynamic([@"cmd.exe", @"powershell.exe", @"pwsh.exe", @"wscript.exe", @"cscript.exe", @"rundll32.exe", @"mshta.exe", @"bitsadmin.exe", @"certutil.exe", @"regsvr32.exe"]);
let AgentExec =
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFolderPath has_any (AgentPath)
| where FileName in~ (SuspiciousChildren)
| project DeviceId, DeviceName, ExecTime = Timestamp, ChildProcess = FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
let Persistence =
DeviceRegistryEvents
| where Timestamp > ago(Lookback)
| where RegistryKey has_any (@"CurrentVersion\Run", @"CurrentVersion\RunOnce", @"ControlSet001\Services", @"ControlSet002\Services", @"\Schedule\TaskCache")
| where not(RegistryValueData has_any (@"N-able", @"Ncentral", @"Microsoft"))
| project DeviceId, PersistTime = Timestamp, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName;
let NetConn =
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFolderPath has_any (AgentPath)
| where RemotePort !in (443, 80) or not(RemoteUrl has_any (@"n-able.com", @"n-able.net", @"solarwindsmsp.com"))
| project DeviceId, NetTime = Timestamp, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName;
AgentExec
| join kind=leftouter Persistence on DeviceId
| join kind=leftouter NetConn on DeviceId
| summarize FirstSeen = min(ExecTime), LastSeen = max(ExecTime),
ChildProcesses = make_set(ChildProcess), Commands = make_set(ProcessCommandLine),
PersistenceKeys = make_set(RegistryKey), RemoteIPs = make_set(RemoteIP)
by DeviceName
| sort by FirstSeen asc
Tune the RemoteUrl allowlist against your tenant's actual N-able infrastructure endpoints — pull the documented FQDNs from your N-central agent configuration before deploying this as an analytic rule.
Velociraptor VQL — Fleet-Wide Persistence Sweep
For IR teams that need to sweep managed endpoints for persistence established during the compromise window, this artifact enumerates services, Run keys, and scheduled tasks whose binaries live outside standard software directories — the telltale of attacker-planted persistence pushed through the RMM channel.
-- Artifact: N-central Post-Compromise Persistence Sweep
-- Enumerates services, Run keys, and scheduled tasks referencing non-standard binary paths
-- Deploy fleet-wide via Velociraptor hunt; triage hits against MSP change records
LET suspicious_paths = '(?i)(\\\\Temp\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\[^\\\\]*\\.exe|\\\\Users\\\\Public\\\\|%TEMP%|/tmp/|/dev/shm/)'
LET services = SELECT Name, DisplayName, PathName, StartName, State
FROM wmi(query='SELECT Name, DisplayName, PathName, StartName, State FROM Win32_Service')
WHERE PathName =~ suspicious_paths
AND NOT PathName =~ '(?i)(N-able|Ncentral|SolarWinds)'
LET runkeys = SELECT Name as ValueName, Data as ValueData, FullPath as KeyPath
FROM glob(
globs=['HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*',
'HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*'],
accessor='registry')
WHERE ValueData =~ suspicious_paths
LET tasks = SELECT Name, Path, CommandLine = CommandLine || '', Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(schtasks|Register-ScheduledTask)'
SELECT 'Service' as ArtifactType, Name, PathName as Detail, StartName as Context, '' as Mtime FROM services
UNION ALL
SELECT 'RunKey' as ArtifactType, ValueName as Name, ValueData as Detail, KeyPath as Context, '' as Mtime FROM runkeys
Remediation & Verification Script
Run this on managed endpoints (and adapt for the N-central server itself) to verify agent health, sweep for recently created persistence, and flag unsigned or oddly-located binaries referencing N-able infrastructure.
# N-central Post-Compromise Triage Script — Run as Administrator on managed endpoints
# Security Arsenal IR Toolkit — August 2026 campaign response
$ReportPath = "$env:ProgramData\NCentral_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
"=== N-central Compromise Triage Report ===" | Out-File $ReportPath
# 1. Verify N-central agent service presence and binary signing
"`n[1] Agent Service & Signature Validation" | Out-File $ReportPath -Append
Get-Service | Where-Object { $_.DisplayName -match 'N-able|Ncentral|N-able Technologies' } | ForEach-Object {
$svc = $_
$path = (Get-CimInstance Win32_Service -Filter "Name='$($svc.Name)'").PathName
$exe = ($path -replace '^"','' -split '"')[0]
if (Test-Path $exe) {
$sig = Get-AuthenticodeSignature $exe
"Service: $($svc.Name) | Status: $($svc.Status) | Signed: $($sig.Status) | Signer: $($sig.SignerCertificate.Subject)" | Out-File $ReportPath -Append
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'N-able') {
" [ALERT] Unsigned or unexpected signer on agent binary: $exe" | Out-File $ReportPath -Append
}
}
}
# 2. Sweep for persistence created in the last 21 days (services, Run keys, tasks)
"`n[2] Recent Persistence Artifacts (last 21 days)" | Out-File $ReportPath -Append
$cutoff = (Get-Date).AddDays(-21)
# New services
Get-CimInstance Win32_Service | Where-Object {
$_.PathName -match 'Temp|AppData|ProgramData|Users\\Public'
} | ForEach-Object { " [SERVICE] $($_.Name) -> $($_.PathName)" | Out-File $ReportPath -Append }
# Run keys pointing at suspicious paths
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($key in $runKeys) {
if (Test-Path $key) {
(Get-ItemProperty $key).PSObject.Properties | Where-Object {
$_.Value -match 'Temp|AppData|Users\\Public' -and $_.Name -notmatch '^PS'
} | ForEach-Object { " [RUNKEY] $key\$($_.Name) = $($_.Value)" | Out-File $ReportPath -Append }
}
}
# Recently created scheduled tasks
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } | ForEach-Object {
$action = ($_.Actions | Select-Object -First 1).Execute
" [TASK] $($_.TaskName) | Created: $($_.Date) | Runs: $action" | Out-File $ReportPath -Append
}
# 3. Recent local administrator account creation
"`n[3] Recently Modified Local Admin Group" | Out-File $ReportPath -Append
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
" [ADMIN] $($_.Name) ($($_.ObjectClass))" | Out-File $ReportPath -Append
}
# 4. Network connections from agent processes to non-N-able destinations
"`n[4] Agent Process Network Activity" | Out-File $ReportPath -Append
$agentProcs = Get-Process | Where-Object { $_.Path -match 'N-able|Ncentral' } -ErrorAction SilentlyContinue
foreach ($proc in $agentProcs) {
Get-NetTCPConnection -OwningProcess $proc.Id -State Established -ErrorAction SilentlyContinue | ForEach-Object {
" [NET] $($proc.Name) (PID $($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort)" | Out-File $ReportPath -Append
}
}
Write-Host "Triage complete. Report: $ReportPath"
Write-Host "Review all [ALERT], [SERVICE], [RUNKEY], [TASK], and unexpected [NET] entries against MSP change records."
Remediation — Priority Actions
1. Apply N-central Hotfix 2 Immediately (and Both Hotfixes If You're Behind)
N-able has released two rounds of hotfixes. If you applied only the first, you are not protected against the evolved techniques. Apply the latest cumulative hotfix from N-able's security advisory channels now:
- N-able Security Advisories: https://www.n-able.com/security-and-compliance/security-advisories
- N-central product updates: Apply via the N-central Server Update mechanism or N-able support channel for your deployment type.
Do not schedule this into a change window next week. Vendor-confirmed active exploitation with persistence means every unpatched hour is attacker dwell time.
2. Assume Breach — Hunt Before You Declare Clean
Patching closes the door; it does not evict anyone already inside. Because persistence is confirmed:
- Audit N-central itself: Review all console user accounts, API tokens/integrations, and automation policies for unauthorized additions. Rotate every credential associated with the N-central instance — console admins, API keys, agent enrollment credentials, and any domain credentials used for discovery or deployment tasks.
- Sweep every managed endpoint with the detections above. Any endpoint that received pushed content during the exposure window is a candidate for hands-on IR.
- Check your customers if you're an MSP. Your compromise is their breach. Downstream notification obligations (contractual and regulatory — HIPAA, PCI-DSS where applicable) start now, not after your internal review concludes.
3. Reduce the RMM Attack Surface Permanently
- Restrict N-central console access to a management VPN or IP allowlist. An internet-exposed RMM console is a standing invitation — this campaign will not be the last.
- Enforce MFA on all N-central console accounts and integrate authentication with your IdP for centralized visibility and conditional access.
- Baseline and alert on agent behavior. Your SOC should know what normal N-central agent execution looks like (signed binaries, expected destinations, scheduled maintenance windows) so that deviations — the detections above — are actionable, not noise.
- Segment managed fleets. Limit the agent's effective privileges and network reachability so a pushed payload cannot traverse laterally into adjacent environments.
4. Monitor for the CVE and CISA KEV Entry
Assign an owner to watch N-able's advisory page and the CISA KEV catalog. If a KEV entry lands, federal civilian agencies get a binding remediation deadline under BOD 22-01 — and that deadline is a useful forcing function for private-sector SLAs too.
The Strategic Lesson
RMM platforms are force multipliers for defenders and attackers alike. When one is compromised, the trust model inverts: the tool your SOC whitelisted becomes the attacker's execution channel. This N-central campaign — with confirmed technique evolution between hotfix rounds and confirmed persistence on managed systems — is a live demonstration. Patch fast, but hunt faster. The hotfix protects tomorrow; only hunting protects yesterday.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.