Loading story…
Attackers rapidly weaponized Atlassian Confluence vulnerability CVE-2021-26084, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the z0Miner botnet, which had previously spread through WebLogic, Elasticsearch, and Jenkins flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed XMRig miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts.
Security researchers also observed broader exploitation beyond z0Miner, including Muhstik, Sysrv-Hello, Setag, BillGates, and Dofloo-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port 23733. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro documented z0Miner exploiting CVE-2021-26084 to deploy web shells, persistence mechanisms, mining components, and scripts that remove competing cryptominers. The report said the infection chain matched earlier z0Miner activity previously reported by 360 Netlab and Tencent Security.
Imperva reported attackers exploiting CVE-2021-26084 against both Linux and Windows Confluence servers to deploy XMRig miners. The company linked the activity to z0Miner based on shared infrastructure, payloads, and tradecraft previously seen in WebLogic, Elasticsearch, and Jenkins campaigns.
A JSP webshell variant used in the Confluence attacks was first submitted to VirusTotal on September 8, 2021. IronNet said the sample closely resembled publicly available Shack2-derived code with minor modifications.
FortiGuard said it observed numerous threat actors exploiting CVE-2021-26084 in September 2021. The campaigns included cryptojacking, Setag backdoor delivery, a fileless PowerShell reverse shell, and Muhstik botnet infections.
IronNet observed active exploitation of internet-facing Confluence servers as early as September 1, 2021. Multiple threat actors were deploying webshells and XMRig-based cryptominers through several distinct infection chains, including activity overlapping with z0Miner indicators.
Atlassian released a security advisory and patch for the Confluence OGNL injection vulnerability CVE-2021-26084. Multiple references explicitly anchor this release to August 25, 2021.
Within days of the patch release, public proof-of-concept exploit code for CVE-2021-26084 was published and became widely available. Several reports link this to rapid follow-on exploitation of exposed Confluence servers.
360 Netlab reported renewed z0Miner activity spreading through ElasticSearch CVE-2015-1427 and a Jenkins script console RCE. The campaign downloaded conf.txt from 27.1.1.34:8080, killed competing miners, established cron persistence, and fetched XMRig components.
The references state that z0Miner became active in 2020 and previously propagated by exploiting Oracle WebLogic remote code execution vulnerabilities CVE-2020-14882 and CVE-2020-14883 to install XMRig miners.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 106 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcefortinet.com
Open sourceironnet.com
Open sourcetrendmicro.com
Open sourceimperva.com
Open sourceblog.netlab.360.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited **Atlassian Confluence** vulnerability `CVE-2022-26134`, a critical unauthenticated remote code execution flaw caused by **OGNL injection**, against on-premises Confluence Server and Data Center systems. Volexity first reported in-the-wild exploitation, and Atlassian confirmed that all supported self-managed versions prior to patched releases were affected, while **Atlassian Cloud was not vulnerable**. Atlassian issued fixed versions including `7.4.17`, `7.13.7`, `7.14.3`, `7.15.2`, `7.16.4`, `7.17.4`, and `7.18.1`, and also published temporary mitigation steps for organizations unable to patch immediately. Follow-on attacks used the exploit’s in-memory shell to deliver a wide range of payloads on both Linux and Windows servers, including **Gafgyt/Mirai-like botnets**, **Monero cryptominers**, **z0miner**, **Cobalt Strike shellcode**, web shells, and a malicious Linux package dubbed **pwnkit**. Sophos also observed attempts to deploy **Cerber ransomware** on Windows systems using `curl` and encoded PowerShell to fetch a payload from the `%temp%` directory, while Barracuda reported sustained exploitation months after disclosure, with automated reconnaissance, architecture-specific malware downloaders, and some malicious infrastructure remaining online for extended periods.
Aug 15, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Researchers reported that the **WatchBog** cryptomining botnet expanded its tooling beyond Linux-focused exploitation by adding a **BlueKeep** scanning module that probes RDP services on TCP `3389` for potentially vulnerable Windows hosts. The malware, active since at least 2018, primarily targets unpatched Linux systems and spreads through a Cython-compiled ELF implant that pulls command-and-control data from Pastebin, falls back to a hardcoded `.onion` service, and communicates over HTTPS without proper certificate validation. That TLS weakness allowed defenders to intercept tasking and victim telemetry, helping estimate roughly **4,500 infections** tied to observed infrastructure, though the total may be higher. Across observed campaigns, WatchBog and related Linux miner activity exploited widely known flaws in **Jira, Exim, Solr, Jenkins, Nexus Repository Manager 3, Confluence (`CVE-2019-3396`)**, and also abused **CouchDB** and **Redis** through brute-force or remote code execution. Once deployed, the operators installed **XMRig** or **XMR-Stak** Monero miners, established persistence with cron jobs, moved laterally over SSH using available keys and `known_hosts`, and in some cases used rootkits or Glibc-hooking libraries to hide processes, files, network traffic, and resource usage. Researchers said the activity underscores continued criminal exploitation of long-patched enterprise software vulnerabilities to build stealthy, self-propagating cryptomining botnets.
Aug 14, 2026