Loading story…
A ransomware strain dubbed NextCry was found encrypting data on self-hosted Nextcloud Linux servers, with victims reporting that files in the platform’s data directory were locked and no free decryptor was available. Researchers said the malware was a Python-based payload packaged as a Linux ELF binary with pyInstaller, using AES-256 for file encryption and an embedded RSA-2048 public key to protect the encryption key. The malware reportedly parsed Nextcloud’s config.php file to locate the correct data directory and also deleted folders that could aid recovery.
Investigators linked the intrusions to exploitation of CVE-2019-11043, a remote code execution flaw in NGINX/PHP-FPM configurations commonly used with some Nextcloud deployments, rather than to a vulnerability in Nextcloud itself. Nextcloud had separately issued an urgent warning about the NGINX/PHP-FPM issue, underscoring that exposed servers using affected default configurations were at risk of compromise and subsequent ransomware deployment.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Nextcloud issued an urgent security alert about CVE-2019-11043, a remote code execution flaw in PHP-FPM affecting certain default NGINX-based Nextcloud deployments. It advised administrators to update PHP packages and NGINX configuration files.
After investigating the incidents, Nextcloud said it was confident the attacker was exploiting the nginx+php-fpm issue covered by its advisory rather than a vulnerability in Nextcloud itself. The reporting also noted that a public exploit for CVE-2019-11043 existed and had been used to compromise servers.
Analysis showed NextCry was a Python script compiled into a Linux ELF binary with pyInstaller that specifically locates Nextcloud's data directory via config.php, deletes some restorable folders, and encrypts files using AES-256 with the key protected by an embedded RSA-2048 public key. At the time of reporting, no free decryptor was available.
A new ransomware strain called NextCry was identified targeting Nextcloud file sync and share servers, with multiple victims reporting infections. Victims reported encrypted files, SSH lockout, and in one case roughly half of files were encrypted before the server was taken offline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Aug 15, 2026
Attackers compromised an internet-facing **Adobe ColdFusion 9** server on **Windows Server 2008** and deployed **Cring ransomware** after exploiting the long-known vulnerabilities `CVE-2010-2861` and `CVE-2009-3960`. The intrusion began with retrieval of sensitive files and upload of a web shell, then expanded into persistence, credential theft, and lateral movement as the operators worked toward **Domain Admin** privileges. Sophos said the attackers also used additional web shells, **Cobalt Strike**, scheduled tasks, **WMIC**, and **PowerShell** during the intrusion. The operators attempted to evade detection by deleting logs, overwriting artifacts, and disabling **Sophos endpoint protection** and **Windows Defender**. They stole registry hives, created an administrative account, shut down hosted virtual machines, deleted **Volume Shadow Copies**, and encrypted both the compromised server and VM disk files roughly 79 hours after the initial breach. The case underscores the exposure created by leaving public-facing, end-of-life systems unpatched, as both **ColdFusion 9** and **Windows Server 2008** were unsupported at the time of the attack.
Aug 15, 2026
Nextcloud left an internal Elasticsearch database publicly accessible, exposing about **367,000 records** and roughly **7.92 GB** of data that included invoices, client contracts, employee information, internal documents, unencrypted email files, beta tester lists, file-sharing metadata, and deployment scripts. Some of the exposed shell and Python scripts reportedly contained hardcoded database credentials, increasing the risk of follow-on compromise, while referenced external domains included providers such as **IONOS** and **STRATO** as well as German government entities including **MSB NRW**. The database was discovered on May 18 and secured on May 27, two days after notification, according to reporting cited by Cybernews and others. Nextcloud said the exposure resulted from a **hosting infrastructure misconfiguration** rather than a flaw in its product, stated that no customer-operated servers were affected, and said it had no evidence of unauthorized access or exploitation before the database was locked down; the company also reported the incident to the relevant state data protection officer.
Jul 10, 2026