Loading story…
Attackers compromised an internet-facing Adobe ColdFusion 9 server on Windows Server 2008 and deployed Cring ransomware after exploiting the long-known vulnerabilities CVE-2010-2861 and CVE-2009-3960. The intrusion began with retrieval of sensitive files and upload of a web shell, then expanded into persistence, credential theft, and lateral movement as the operators worked toward Domain Admin privileges. Sophos said the attackers also used additional web shells, Cobalt Strike, scheduled tasks, WMIC, and PowerShell during the intrusion.
The operators attempted to evade detection by deleting logs, overwriting artifacts, and disabling Sophos endpoint protection and Windows Defender. They stole registry hives, created an administrative account, shut down hosted virtual machines, deleted Volume Shadow Copies, and encrypted both the compromised server and VM disk files roughly 79 hours after the initial breach. The case underscores the exposure created by leaving public-facing, end-of-life systems unpatched, as both ColdFusion 9 and Windows Server 2008 were unsupported at the time of the attack.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Windows Server 2008 reached end of life in January 2020. Sophos said this meant the victim could not patch the operating system during the intrusion.
Adobe ColdFusion 9 was no longer supported as of 2016. Sophos noted this left the victim unable to patch the ColdFusion software at the time of the attack.
About 79 hours after the initial breach, the attackers executed a ransomware binary named msp.exe. It encrypted the compromised server and folders containing virtual machine disk images.
After discovering the compromised server hosted a hypervisor, the attackers executed a PowerShell command to stop and power off virtual machines.
When some activity was blocked, the attackers used the web shell to disable Sophos endpoint protection and Windows Defender. Sophos noted Tamper Protection was not enabled on the compromised machine.
The intruders created a local administrative user named agent$ with password P@ssw0rd, profiled the environment, obtained Domain Admin privileges, and executed remote commands on other servers. They also dropped Cobalt Strike beacons onto additional machines in the victim network.
About five hours after stealing the registry hives, the attackers used WMIC to invoke PowerShell and download files named 01.css and 02.css from an IP address geolocating to Belarus.
The attackers placed a second web shell, cfiut.cfm, in the ColdFusion /CFIDE/ directory and used it to export the HKLM\SAM, HKLM\Security, and HKLM\System registry hives. They saved the hives with .png extensions in a public web path, downloaded them, and deleted them.
Roughly 62 hours after the initial compromise, the attackers returned and used the beacon to upload files and execute commands. They dropped files into ProgramData and created a scheduled task using wscript.exe with hexadecimal-encoded parameters for persistence.
Using the web shell, the attackers attempted to load a Cobalt Strike beacon onto the server. They later overwrote the web shell file with garbled data to hinder forensic investigation.
The intruders exploited CVE-2010-2861 to retrieve password.properties and then abused CVE-2009-3960 via /flex2gateway/amf to upload a web shell. Sophos recovered the shell from a CSS file in the ColdFusion webroot.
The attacker scanned the target website from an IP address assigned to Ukrainian ISP Green Floid, requesting more than 9,000 paths in 76 seconds. The scan identified ColdFusion-specific paths including /admin.cfm, /login.cfm, and /CFIDE/Administrator/.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process `w3wp.exe` to run reconnaissance and deploy multiple steganographic webshells, including `UA4fp7R.aspx` and `WRBYTR5750images.aspx`. Huntress reported the intruder embedded the marker **ONEPIECE** in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete. The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling `WDigest` `UseLogonCredential`, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Jul 2, 2026
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026