Executive Summary
Beginning November 12, 2026, threat actors began weaponizing the 4EverAble2Shell and Agent2Shell proof-of-concept exploits to target N-able N-central servers. The attack chain bypasses recent security updates, specifically N-central 2026.4 Hotfix 2, when the Legacy API is enabled. Once access is gained, the attackers utilize a multi-stage Python-based local privilege escalation to gain root access and deploy XMRig Monero miners.
The campaign has successfully infected at least 21 production N-central servers across various global regions, including the US, South Africa, and Canada. While the current payload is limited to cryptomining, the nature of N-central as a remote monitoring and management (RMM) tool means that a successful compromise grants the attacker potential access to all downstream client endpoints managed by the affected server.
Immediate action is required for organizations using N-central. The exploit leverages the Apache Axis SOAP endpoint and remains effective despite patches if the Legacy API remains active. Defenders should treat any detected activity as a full server compromise rather than a simple malware infection due to the high-level access obtained by the threat actor.