Continuous attack attempts discovered on Atlassian Confluence zero day

Following a coordinated disclosure of a zero-day vulnerability by Volexity in Atlassian Confluence, now known as CVE-2022-26134, attackers went wild to exploit it, according to Barracuda. 

Since the original disclosure and subsequent publication of various proofs of concept, researchers at Barracuda have analysed data from their installations worldwide and discovered large numbers of attempts to exploit this vulnerability. 

The exploit attempts range from benign reconnaissance to some relatively complex attempts to infect systems with DDoS botnet malware and cryptominers.

Atlassian Confluence is a tool that provides collaborative documentation. According to Barracuda, on June 2, information about CVE-2022-26134 was publicly released. Over the next weekend, various threat actors used the vulnerability and in no-time malicious actors became aware of it. The vulnerability allows unauthenticated, remote attackers to create new administrative accounts, execute privileged commands, and seize control of the servers.

Initially, Barracuda researchers were seeing a steady flow of attacks attempting to exploit this vulnerability, with several significant spikes. With the continuous monitoring on these attacks, and on the pattern, the researchers found that the overall volume dropped slightly in August. Attackers clearly have not given up on trying to exploit this vulnerability.

Exploitation attempts primarily originated from IP addresses in Russia, followed by the U.S., India, Netherlands, and Germany. Previous research showed that some of the payloads being delivered and the sources of the attacks.

"There is a steady flow of attacks over time and we foresee a significant amount of scanning and such attempts to continue for the time being," says Tushar Richabadas, Senior Product Marketing Manager, Applications and Cloud Security, Barracuda.

"It is important to take steps to protect your systems. Now is the ideal time to opt for patching, especially if the system is internet-facing. Placing a web application firewall in front of such systems will provide an in-depth defense against zero-day attacks and other vulnerabilities."

Earlier this year, Barracuda research identified huge spike in ransomware. Over the past 12 months, Barracuda researchers identified and analysed 106 highly publicised ransomware attacks and found the dominant targets are still five key industries: education, municipalities, healthcare, infrastructure, and financial.

The volume of ransomware threats detected spiked between January and June of this year to more than 1.2 million per month.

The number of ransomware attacks increased year-over-year across each of the five industry verticals, and attacks against other industries more than doubled compared to the previous year.

Just last week, the company announced product milestones and strong business growth for its data protection business, which it said accelerated due to the increasing need for secure backup driven by ransomware and other cyber threats.

Through cloud-first innovations, Barracuda grew its data protection new business sales by 30% year-over-year at the end of Q2FY23.