Confluence RCE Attacks Deploy Godzilla Web Shells and Monero Miners
Active Exploitation · 7 sources · Updated 1mo ago · First seen Jun 2, 2022
Attackers exploited unpatched Atlassian Confluence servers through remote code execution vulnerabilities CVE-2021-26084 and CVE-2022-26134 to install web shells and cryptocurrency miners. AhnLab ASEC observed widespread deployment of Godzilla JSP web shells, which use encrypted communications and dynamic Java class loading to maintain remote control. Mining campaigns involving 8220 Gang, z0Miner, and Hezb ultimately deployed XMRig to mine Monero; 8220 Gang was also observed targeting servers in South Korea.
The campaigns used techniques including process injection, removal of competing miners, disabling security controls, and service-based execution. Separate Lacework reporting highlighted 8220 Gang’s use of a custom miner and botnet, reinforcing the group’s broader cryptomining activity beyond Confluence exploitation. Organizations should patch vulnerable Confluence installations and restrict external access, as ASEC recommends, while investigating unexpected JSP files, unauthorized services, and mining processes. Remediation should address both resource theft and persistent access through planted web shells.
