N-central servers running Hotfix 2 were still turning up as cryptocurrency miners after a second exploit chain appeared. Huntback’s November 12 investigation found 21 active mining labels matching live N-central servers; 19 displayed the HF2 build. The crucial exposure condition is Legacy API enabled and reachable from the internet, rather than HF2 installation alone. N-able’s November 13 response provides indicators to investigate and says administrators should keep that API disabled.[1][2]
A probe became a root-level miner
Huntback recorded the first check against its N-central decoys at 08:30 UTC on November 12. At 09:16, the same source sent a weaponized request. The chain first executed through the application’s nable account, then abused a maintenance helper to gain root privileges. The next command installed an XMRig Monero miner.
The miner gave investigators an unusually visible trail: each rig’s label incorporated a target IP address. At 12:50 UTC, a public mining-pool account showed 21 such rigs submitting shares. Those addresses served N-central login pages, and 19 reported build 2026.4.1.26, released as HF2 on November 10. That is a dated observation of one operator’s infrastructure, not a worldwide victim total or a forensic examination of every server.
The installer also tried to blend into normal server activity by limiting processor use. A management server need not become obviously unusable for an intruder to be running code with its highest privileges. A quiet dashboard therefore cannot substitute for checking exposure and activity.
The setting that changes the exposure
HF2 addressed the earlier disclosure. The later chain, called 4EverAble2Shell, introduced a separate problem. N-able says Legacy API is off by default; customers must deliberately enable it for older functions. Huntress’s updated guidance says HF2 servers with that API disabled are not exposed to this server exploit chain.[3][4]
For an on-premises deployment, verify the actual setting and network reachability. If a business dependency requires Legacy API, Huntress recommends restricting access so it is not internet-exposed. If it was enabled and reachable, review server and managed-endpoint activity from November 11 onward. Disabling the route closes an exposure; it does not establish that an earlier intrusion never happened.
N-able’s published indicators include connections to 157.20.241[.]16 on port 8080 and callback ports 19202–19418, plus mining traffic to 139.99.69[.]109:10128 or 79.76.51[.]56:39100. Correlate matches with process execution, downloads and persistence records rather than treating one address match as a complete incident assessment.
Keep the two disclosures separate
The November 13 remediation statement also describes Agent2Shell and plans for HF3: stronger authentication between components and permanent removal of Legacy API access. Those are the vendor’s dated plans, not proof of a release or of endpoint compromise in Huntback’s observed miner case. Check the current vendor release and upgrade instructions when acting. N-able also temporarily disabled Intune integration as a precaution and tells customers to update Agents and Probes; hosted server protections are applied by the vendor.
This November incident is separate from the August N-central intrusion and Cloudflared hunt. The broader trust problem also appears in SCKit’s attack on remote-support technicians: management access is itself a valuable target. Here, the practical dividing line is the API’s real exposure and the evidence left during that exposure—not the presence of an HF2 version string.
References
- Huntback Research. “4EverAble2Shell is already mining Monero on live N-central servers.” November 12, 2026. Investigation and observations.
- N-able. “New Security Update on N-central.” November 13, 2026. Official indicators and product actions.
- N-able. “N-able Vulnerability Remediation Update.” November 13, 2026. Disclosure scope and hotfix plans.
- Huntress. “N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains.” Updated November 13, 2026; accessed November 14, 2026. Updated exposure and response guidance.
