z0Miner and Other Botnets Exploit Confluence RCE to Deploy Miners and Backdoors

Attackers rapidly weaponized Atlassian Confluence vulnerability CVE-2021-26084, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the z0Miner botnet, which had previously spread through WebLogic, Elasticsearch, and Jenkins flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed XMRig miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts.

Security researchers also observed broader exploitation beyond z0Miner, including Muhstik, Sysrv-Hello, Setag, BillGates, and Dofloo-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port 23733. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.