Loading story…
Atom Silo ransomware operators breached enterprise networks by exploiting Atlassian Confluence vulnerability CVE-2021-26084, a critical OGNL injection flaw that allows unauthenticated remote command execution on internet-facing Confluence Server and Data Center systems. Security reporting showed the bug was mass-scanned and quickly weaponized after patches were released, with attackers using the exposed server as an entry point to establish persistence through DLL sideloading of a legitimate McAfee VirusScan Enterprise executable and a stealthy backdoor.
After gaining access, the attackers moved laterally with WMI, compromised additional servers, exfiltrated data with Rclone to Dropbox, and then deployed Atom Silo ransomware across the environment via domain controllers and Group Policy. Sophos reported the operators also installed a kernel driver to disable endpoint protections before launching encryption, while reverse-engineering of the malware showed a 64-bit Windows payload using a hybrid RSA/AES scheme, dropping ransom notes, appending the .ATOMSILO extension, and threatening to leak stolen data unless victims paid up to $1 million in Bitcoin.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
On September 24, the attackers performed discovery on an important server, checked volumes and RDP session history, then used Rclone to exfiltrate data from several directories to Dropbox.
The Atom Silo intrusion began with exploitation of the Atlassian Confluence OGNL injection vulnerability on an internet-facing server. Sophos said the earlier initial access was obtained on September 13.
AtomSilo's leak site published around 900 GB of data stolen from a Brazilian pharmaceutical company, demonstrating the group's double-extortion model of combining encryption with public data leaks. The reference identifies this as the group's first published data leak.
Atlassian released fixes for the critical Confluence OGNL injection vulnerability CVE-2021-26084, which can allow authentication bypass and command injection on self-hosted Confluence systems.
A public reverse-engineering write-up detailed AtomSilo's encryption workflow, ransom-note generation, file-skipping logic, mutex use, and its use of RSA and AES to encrypt files and append the .ATOMSILO extension.
After exfiltration, the operators connected to the domain controller, copied payloads into the netlogon folder, used scheduled tasks or a Group Policy-based service named Update, disabled protections with a kernel driver, and launched Atom Silo ransomware across systems.
During the same incident, a different threat actor also exploited the vulnerable Confluence server and implanted cryptocurrency miner malware, showing multiple actors were abusing the flaw.
After compromising the Confluence server, the attackers deployed a stealthy backdoor using a legitimate McAfee executable and malicious DLL sideloading, then used WMI and a compromised administrative account to move laterally. Sophos said several additional servers were compromised within five hours.
Shortly after the patch release, researchers observed mass scanning and initial in-the-wild exploitation of vulnerable Confluence servers, while public technical write-ups and proof-of-concept payloads were published.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcezscaler.com
Open sourcechuongdong.com
Open sourcetherecord.media
Open sourceconfluence.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited **Atlassian Confluence** vulnerability `CVE-2022-26134`, a critical unauthenticated remote code execution flaw caused by **OGNL injection**, against on-premises Confluence Server and Data Center systems. Volexity first reported in-the-wild exploitation, and Atlassian confirmed that all supported self-managed versions prior to patched releases were affected, while **Atlassian Cloud was not vulnerable**. Atlassian issued fixed versions including `7.4.17`, `7.13.7`, `7.14.3`, `7.15.2`, `7.16.4`, `7.17.4`, and `7.18.1`, and also published temporary mitigation steps for organizations unable to patch immediately. Follow-on attacks used the exploit’s in-memory shell to deliver a wide range of payloads on both Linux and Windows servers, including **Gafgyt/Mirai-like botnets**, **Monero cryptominers**, **z0miner**, **Cobalt Strike shellcode**, web shells, and a malicious Linux package dubbed **pwnkit**. Sophos also observed attempts to deploy **Cerber ransomware** on Windows systems using `curl` and encoded PowerShell to fetch a payload from the `%temp%` directory, while Barracuda reported sustained exploitation months after disclosure, with automated reconnaissance, architecture-specific malware downloaders, and some malicious infrastructure remaining online for extended periods.
Aug 15, 2026
Attackers rapidly weaponized **Atlassian Confluence** vulnerability `CVE-2021-26084`, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the **z0Miner** botnet, which had previously spread through **WebLogic, Elasticsearch, and Jenkins** flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed **XMRig** miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts. Security researchers also observed broader exploitation beyond z0Miner, including **Muhstik**, **Sysrv-Hello**, **Setag**, **BillGates**, and **Dofloo**-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port `23733`. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
Aug 14, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026