Source-reported · Independent verification status is not recorded for this article; claims remain attributed to their sources.
N‑able N‑central hack hits 21 servers even after hotfix, security researchers say
Hackers breached 21 N‑able N‑central servers and deployed cryptocurrency miners by exploiting critical flaws, including on 19 systems already running Hotfix 2, showing that the update alone didn’t stop attackers from gaining root access.
A fresh security incident involving N‑able’s N‑central product shows how attackers can still penetrate remote‑management tools even after urgent patches are applied.
According to a report highlighted by The Hacker News, hackers compromised 21 servers running N‑central, a remote monitoring and management platform. The attackers exploited critical vulnerabilities to gain root access, the highest level of control on those systems, and then installed cryptocurrency mining software.
Nineteen of the 21 hacked servers were already running “Hotfix 2,” an update that administrators had deployed in response to earlier warnings. The fact that those installations were still breached has alarmed security teams, because it suggests Hotfix 2 by itself did not fully block the techniques used in this campaign.
Once an attacker gains root access to an N‑central server, they can use it as a powerful springboard into networks managed through that platform. In this case, the intruders deployed crypto miners that hijack computing power to generate digital currency. The same access could, in principle, be used for more disruptive actions such as ransomware or data theft.
Organizations that rely on N‑central through their IT providers may not have direct visibility into the state of those servers but still face knock‑on risks if a management layer they depend on is compromised.
Key developments to watch include any new technical guidance or patches from N‑able, reports of follow‑on incidents on customer networks tied to the 21 breached servers, and whether government cybersecurity agencies flag this campaign in broader advisories about attacks on remote‑management platforms.