Loading story…
Attackers actively exploited Atlassian Confluence vulnerability CVE-2022-26134, a critical unauthenticated remote code execution flaw caused by OGNL injection, against on-premises Confluence Server and Data Center systems. Volexity first reported in-the-wild exploitation, and Atlassian confirmed that all supported self-managed versions prior to patched releases were affected, while Atlassian Cloud was not vulnerable. Atlassian issued fixed versions including 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1, and also published temporary mitigation steps for organizations unable to patch immediately.
Follow-on attacks used the exploit’s in-memory shell to deliver a wide range of payloads on both Linux and Windows servers, including Gafgyt/Mirai-like botnets, Monero cryptominers, z0miner, Cobalt Strike shellcode, web shells, and a malicious Linux package dubbed pwnkit. Sophos also observed attempts to deploy Cerber ransomware on Windows systems using curl and encoded PowerShell to fetch a payload from the %temp% directory, while Barracuda reported sustained exploitation months after disclosure, with automated reconnaissance, architecture-specific malware downloaders, and some malicious infrastructure remaining online for extended periods.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
After disclosure and proof-of-concept publication, Barracuda observed large numbers of exploitation attempts ranging from reconnaissance to malware delivery. It said the attack pattern continued through the summer, with only a slight drop in overall volume by August.
On June 2, 2022, Atlassian published a security advisory for Confluence Server and Data Center, confirmed active exploitation, released fixed versions, and provided temporary mitigation steps for customers unable to upgrade immediately.
On June 2, 2022, Volexity coordinated disclosure of CVE-2022-26134, an Atlassian Confluence remote code execution vulnerability that was already under active exploitation in the wild.
Barracuda reported that the earliest URLhaus submissions for an IP serving Gafgyt malware dated to late May 2022, indicating the malicious infrastructure used in later Confluence exploitation had been active for months.
Barracuda detailed multiple payload chains delivered via CVE-2022-26134, including a shell script that fetched architecture-specific Gafgyt binaries, a Windows Monero cryptominer chain that disabled Defender, and a likely Linux cryptominer payload. The report also noted some of the malicious infrastructure remained online at the time of writing.
Sophos tracked several attacks against vulnerable Windows and Linux Confluence servers, including two Windows incidents where attackers used the exploit-created in-memory shell to try to deploy Cerber ransomware. Sophos said CryptoGuard blocked both ransomware attempts before damage occurred and found no evidence of data exfiltration or lateral movement in those cases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcenews.sophos.com
Open sourcecve.mitre.org
Open sourceblog.barracuda.com
Open sourcembsd.jp
Open sourcembsd.jp
Open sourceconfluence.atlassian.com
Open sourcevolexity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers rapidly began exploiting **CVE-2023-22527**, a critical `CVSS 10.0` remote code execution flaw in **Atlassian Confluence Data Center and Confluence Server**, within days of public disclosure. The vulnerability affects outdated Confluence 8 releases issued before December 5, 2023, as well as version `8.4.5`, and stems from **OGNL expression injection** that can let unauthenticated attackers execute arbitrary code on exposed servers. Telemetry from Shadowserver Foundation and The DFIR Report recorded nearly **40,000 exploitation attempts** over three days from more than **600 unique IP addresses**, indicating broad opportunistic scanning across the internet. Observed activity included callback testing and basic reconnaissance such as running `whoami`, suggesting attackers were validating access for potential follow-on compromise; at the time, more than **11,000 Atlassian instances** were internet-accessible, underscoring the exposure risk for unpatched organizations.
Aug 15, 2026
Attackers rapidly weaponized **Atlassian Confluence** vulnerability `CVE-2021-26084`, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the **z0Miner** botnet, which had previously spread through **WebLogic, Elasticsearch, and Jenkins** flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed **XMRig** miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts. Security researchers also observed broader exploitation beyond z0Miner, including **Muhstik**, **Sysrv-Hello**, **Setag**, **BillGates**, and **Dofloo**-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port `23733`. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
Aug 14, 2026
Atom Silo ransomware operators breached enterprise networks by exploiting **Atlassian Confluence** vulnerability `CVE-2021-26084`, a critical OGNL injection flaw that allows unauthenticated remote command execution on internet-facing Confluence Server and Data Center systems. Security reporting showed the bug was mass-scanned and quickly weaponized after patches were released, with attackers using the exposed server as an entry point to establish persistence through **DLL sideloading** of a legitimate McAfee VirusScan Enterprise executable and a stealthy backdoor. After gaining access, the attackers moved laterally with **WMI**, compromised additional servers, exfiltrated data with **Rclone** to Dropbox, and then deployed Atom Silo ransomware across the environment via domain controllers and **Group Policy**. Sophos reported the operators also installed a kernel driver to disable endpoint protections before launching encryption, while reverse-engineering of the malware showed a 64-bit Windows payload using a hybrid **RSA/AES** scheme, dropping ransom notes, appending the `.ATOMSILO` extension, and threatening to leak stolen data unless victims paid up to **$1 million in Bitcoin**.
Aug 15, 2026