Loading story…
A sophisticated threat actor launched a large-scale exploitation campaign over the Christmas 2025 holiday, generating more than 2.5 million malicious requests targeting Adobe ColdFusion servers and 47 other technology platforms. The operation, attributed to infrastructure based in Japan, focused on exploiting both legacy and recent vulnerabilities, with a particular emphasis on ColdFusion CVEs from 2023–2024. Attackers timed their campaign to coincide with holiday downtime, aiming to exploit reduced monitoring by security teams, and used advanced scanning tools and out-of-band callback verification to maximize their reach and effectiveness.
The campaign included systematic reconnaissance across 767 distinct CVEs, with notable targeting of vulnerabilities such as CVE-2022-26134 (Confluence OGNL injection) and CVE-2014-6271 (Shellshock). The primary ColdFusion attack vector involved WDDX deserialization leading to JNDI/LDAP injection via the com.sun.rowset.JdbcRowSetImpl gadget chain. The United States was the most targeted country, accounting for 68% of ColdFusion attack sessions. Analysis suggests the use of automated tools like Nuclei for template-based scanning, and the attackers leveraged ProjectDiscovery Interactsh for callback verification, deploying nearly 10,000 unique OAST domains.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers released indicators of compromise for the campaign and recommended blocking the identified IPs and ASNs, deploying detection signatures, and prioritizing patching of ColdFusion and Java-based systems. The published analysis highlighted the operation's systematic, template-driven scanning and likely initial-access-broker interest.
Analysis of the holiday campaign found that about 98% of the ColdFusion attack traffic came from a single threat actor operating through Japan-based infrastructure tied to CTG Server Limited. The same infrastructure had prior associations with phishing activity and poor abuse enforcement.
On December 25, attackers sent roughly 5,940 malicious requests against Adobe ColdFusion servers, primarily targeting CVEs from 2023 and 2024 using JNDI/LDAP injection and Interactsh for out-of-band verification. Most targeted systems were in the United States, Spain, and India.
During the Christmas 2025 holiday period, a large-scale automated campaign generated more than 2.5 million malicious requests targeting 767 CVEs across 47 technology stacks, including Adobe ColdFusion. The activity was timed to coincide with reduced holiday staffing and appears to have focused on reconnaissance followed by exploitation attempts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026
Attackers compromised an internet-facing **Adobe ColdFusion 9** server on **Windows Server 2008** and deployed **Cring ransomware** after exploiting the long-known vulnerabilities `CVE-2010-2861` and `CVE-2009-3960`. The intrusion began with retrieval of sensitive files and upload of a web shell, then expanded into persistence, credential theft, and lateral movement as the operators worked toward **Domain Admin** privileges. Sophos said the attackers also used additional web shells, **Cobalt Strike**, scheduled tasks, **WMIC**, and **PowerShell** during the intrusion. The operators attempted to evade detection by deleting logs, overwriting artifacts, and disabling **Sophos endpoint protection** and **Windows Defender**. They stole registry hives, created an administrative account, shut down hosted virtual machines, deleted **Volume Shadow Copies**, and encrypted both the compromised server and VM disk files roughly 79 hours after the initial breach. The case underscores the exposure created by leaving public-facing, end-of-life systems unpatched, as both **ColdFusion 9** and **Windows Server 2008** were unsupported at the time of the attack.
Aug 15, 2026