Research

N-central 4EverAble2Shell Is Now Exploited: 21 Live Servers Mining Monero, 19 of Them on HF2. Hunt for /tmp/.xvd and xvd.service Today

Patrick Duggan · · 7 min read

N-central 4EverAble2Shell Is Now Exploited: 21 Live Servers Mining Monero, 19 of Them on HF2. Hunt for /tmp/.xvd and xvd.service Today

If you run N-able N-central on your own server and the Legacy API was ever switched on, check that server today for a Monero miner: look for the folders /tmp/.xvd or /var/tmp/.xvd, a systemd unit at /etc/systemd/system/xvd.service, a file /etc/cron.d/xvd, and a crontab line ending in "# xvkeep". If any of them is there, treat the server as compromised, not as something to clean up. The 4EverAble2Shell chain we wrote about this morning is now being used against real servers.

What we covered earlier today, and still stands: the exploit, the Legacy API precondition, and N-able's first notice are in our post "New Public Exploits Claim to Beat N-central's HF2 Fix" (https://www.dugganusa.com/post/n-central-hf2-new-exploits-disable-legacy-api). This post adds only what changed since: confirmed exploitation, the indicators that came with it, N-able's new notice, and the catalog status.

What is confirmed

The primary source for the "21 systems" figure BleepingComputer reported is Huntback, in a research post dated November 12 (huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers). Its method matters, so here it is.

  • At 12:50 UTC on November 12, Huntback looked up the attacker's Monero wallet on the public mining pool's per-worker statistics page. It counted the workers whose names start with "nc_" followed by an IP address, which is the naming the attacker's installer uses. All 21 had submitted valid work between 12:45 and 12:50 UTC.
  • Huntback then made ordinary HTTPS requests to each of those 21 addresses and found that all of them serve the N-central login page.
  • Of the 21, 19 report build 2026.4.1.26, which is N-central 2026.4 Hotfix 2, the fix N-able released on November 10. One reports 2025.3.1.9. Huntback does not give the build of the last one.
  • By country: United States 9, South Africa 4, Canada 4, and one each in the United Kingdom, Germany, France and Sweden.

The population behind that number is narrow and worth naming: 21 N-central servers that were mining for one attacker wallet, at one pool, inside one five-minute window. It is a floor. A server that was compromised but had stopped mining, had been rebooted, or mined somewhere else would not appear. It is not a count of all compromised servers, and nobody has published one.

Huntback's timeline, all UTC on November 12: the researcher published the exploit at 03:58; the first check, a SOAP fault sent to /dms/services/ServerUI, came from 157.20.241[.]16 at 08:30; the first weaponised request came at 09:16; the 21-worker count was taken at 12:50. That is about five hours from public code to the first attack, and under nine hours to 21 mining servers.

Previdian, the second party, independently recorded exploitation attempts from one address on its N-central sensor and added the flaw to its own exploited-vulnerabilities list at 09:45 UTC as VULN-2026-0009. Its public page shows 2 attempts, 1 attacker IP, 1 sensor, and says plainly that its sensor observations "do not show that the target was vulnerable or that the attempt succeeded." Huntback's count is the evidence of success; Previdian's is evidence of attempts. They are two separate parties, and both name the same source address.

What the attacker does, per Huntback

The first request is a crafted SOAP fault to /dms/services/ServerUI that names jline.internal.TerminalLineSettings as the exception class, the Apache Axis weakness described in our earlier post. A Python script then lifts the nable service account to root by abusing N-central's setLDFileOwner helper with a symbolic link, which makes a root-owned script writable. The root command fetches an installer, jup.sh, which drops XMRig and sets it to use about half the CPU cores. Persistence is three ways at once: a systemd service, a cron.d file and a user crontab line.

Indicators Huntback published

We copied these from Huntback's post. Addresses are defanged.

  • Operator host: 157.20.241[.]16. It serves the installer at hxxp://157.20.241[.]16:8080/jup.sh, plus /xvgz and /xmrig.tgz on the same port, and receives beacons at /ob/cronhit and /ob/fcheck. Huntback lists callback ports TCP 19202 to 19418.
  • Mining pool addresses: 139.99.69[.]109 port 10128 (primary) and 79.76.51[.]56 port 39100 (fallback).
  • Monero wallet: 41wx2Pv3FzfRvX11jQgzM4bRbgvr6GViRXCKkHhXhLVQ64mgUR5ks4CEzHx8zqUJ8MgsWwTaWiS3uiZbCgJQnNXoB19mGtr
  • SHA-256 of the nable-to-root Python script: fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747
  • User agents: python-requests/2.31.0 on the weaponised requests, a bare Mozilla/5.0 on the checks.
  • Miner command line contains "--rig-id nc_" and "--donate-level 1".
  • Files: /tmp/.xvd/ and /var/tmp/.xvd/ holding x, keep.sh and xm.log; /etc/systemd/system/xvd.service; /etc/cron.d/xvd; a crontab line ending "# xvkeep"; leftovers named serverchild-.bak, serverchild-.sh and serverchild-*.out under /var/opt/n-central/tmp/. Huntback also lists /var/opt/n-central/flag/flag_default.json, /opt/nable/var/ncsai/scripts/ServerChild.sh and /opt/nable/usr/sbin/nable_wrapper.pl as files the chain touches. Those last three are part of N-central itself, so check them for changes, not for presence.

What N-able says now

N-able's notice changed. The incident we quoted this morning, event 202609, no longer shows on its status dashboard; the link now lands on the dashboard home page. The active notice is event 202613, "November 12 Update: Critical N-central Security Update", started 16:00 UTC, status "Identified", covering both hosted and on-premises N-central in all three regions. The dashboard read "Last Updated: Nov 12, 2026 23:33:12 UTC" when we loaded it.

The new points in it, quoted:

  • "We are restricting certain N-central features and integrations."
  • For hosted customers: "Intune integration has been turned off while additional protections are implemented and validated."
  • For on-premises customers: "if you are running the Intune integration, we have temporarily deactivated it for you. If we were unable to execute this, our support team will make contact with you."
  • "Importantly, we have seen no signs of compromise."

That last sentence and Huntback's 21 mining servers cannot both describe the same set of servers. One possible reading: N-able's statement covers what N-able itself can see, and the 21 are customer-run servers it cannot. N-able has not said, and the notice has not been updated to mention Huntback's findings as of the time above. The notice also does not mention Agent2Shell by name, does not announce a new hotfix, and does not say why Intune was switched off.

Catalog status

CISA's Known Exploited Vulnerabilities catalog, which we downloaded directly, is still at version 2026.11.10. It holds none of CVE-2026-90436, the Apache Axis flaw under this chain, or any of the HF2 CVEs. Its N-central entries are the same five as this morning. No CVE has been assigned to 4EverAble2Shell itself in anything we read; Previdian tracks it as VULN-2026-0009, and the "KEV" BleepingComputer mentions is Previdian's own list, not CISA's.

What to do

  1. Hunt first, then patch. On every on-premises N-central server, check for the files and the systemd, cron.d and crontab entries listed above, for a process with "--rig-id nc_" on its command line, and for outbound connections to 157.20.241[.]16 or to 139.99.69[.]109 port 10128 or 79.76.51[.]56 port 39100. In the web server logs, look for POST requests to /dms/services/ServerUI carrying a SOAP fault with an exceptionName element, especially from python-requests/2.31.0.
  2. A hit means rebuild. Huntback's advice, which we agree with: a hit is a full compromise. The attacker had root on the machine that pushes commands to every endpoint you manage. Rebuild the server, rotate every credential stored in or reachable from it, and review what it sent to managed devices since 08:30 UTC November 12.
  3. Being on HF2 does not clear you. 19 of the 21 were on it. What decides exposure is whether the Legacy API was on. Turn it off and confirm it from outside your network, as in our earlier post.
  4. Block the published addresses at your firewall. Outbound to the two pool addresses on the listed ports, and both directions to 157.20.241[.]16.
  5. Expect Intune to be off. If your N-central Intune integration stopped working today, that is N-able's doing, per its notice. Do not turn it back on until N-able says to.

What is not known

How many servers were compromised in total, beyond the 21 mining at one moment. Whether the attacker did anything on those servers besides mining, including anything pushed to managed endpoints. Whether anyone is using Agent2Shell in the wild. Who the attacker is; Huntback names no actor. Whether N-able's "no signs of compromise" takes Huntback's findings into account. When a fix ships.

How we know, and how we checked

We read Huntback's post and Previdian's VULN-2026-0009 page directly, N-able's status dashboard in a browser (its event pages are rendered by script and returned nothing to a plain fetch), and the CISA KEV JSON. BleepingComputer (Lawrence Abrams, November 12) was our lead to Huntback; everything above about the 21 comes from Huntback's own post.

Our own edge: we searched every edge instrument since November 1 for requests to /dms/ paths, for jup.sh, /ob/cronhit, /ob/fcheck and xmrig.tgz, and for the address 157.20.241[.]16. Zero matches in 322,389 edge blocks, 41,147 edge canary hits and 374 origin honeypot captures. We run no N-central and have no N-central trap, so this says nobody sent those requests to our domains, not that N-central servers are not being attacked.

Our feed held none of these indicators before today. We added three, all from Huntback's post and labelled as its research, not our observation: the operator address 157.20.241[.]16, the installer URL on it, and the root-escalation script's SHA-256, each at confidence 90 under the source manual-batch-n-central-4everable2shell-exploited-cryptominers. We did not add the two pool addresses: Huntback describes the pool as public, and an address that serves other miners besides this attacker does not belong on a blocklist we publish for everyone. Block them on your own network if you do not run miners. We did not add the wallet, which is not a network indicator.

Sources

Huntback Research, blog post, November 12, 2026, https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers. Previdian, VULN-2026-0009. N-able, status dashboard incident 202613, "November 12 Update: Critical N-central Security Update", November 12, 2026, and incident 202584. CISA Known Exploited Vulnerabilities catalog, version 2026.11.10. BleepingComputer, "New N-able '4EverAble2Shell' zero-day exploited hours after PoC released", Lawrence Abrams, November 12, 2026. Our earlier post: "New Public Exploits Claim to Beat N-central's HF2 Fix", November 12, 2026.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register