Barracuda Researchers identifies Continuous attack attempts on Atlassian Confluence zero day
In the follow-up Threat Spotlight, Barracuda looked in more detail at a few of the payloads being delivered by malicious actors attempting to exploit CVE-2022-26134.
Following a coordinated disclosure of a zero-day vulnerability by Volexity in Atlassian Confluence, now known as CVE-2022-26134, attackers went wild to exploit it. Since the original disclosure and subsequent publication of various proofs of concept, researchers at Barracuda, a trusted partner and leading provider of cloud-first security solutions, have analyzed data from their installations worldwide and discovered large numbers of attempts to exploit this vulnerability. The exploit attempts range from benign reconnaissance to some relatively complex attempts to infect systems with DDoS botnet malware and cryptominers.
Atlassian Confluence is a tool that provides collaborative documentation. On June 2, information about CVE-2022-26134 was publicly released. Over the next weekend, various threat actors used the vulnerability and in no-time malicious actors became aware of it. The vulnerability allows unauthenticated, remote attackers to create new administrative accounts, execute privileged commands, and seize control of the servers.
Initially, Barracuda researchers were seeing a steady flow of attacks attempting to exploit this vulnerability, with several significant spikes. With the continuous monitoring on these attacks, and on the pattern, the researchers found that the overall volume dropped slightly in August. Attackers clearly have not given up on trying to exploit this vulnerability.
Exploitation attempts primarily originated from IP addresses in Russia, followed by the U.S., India, Netherlands, and Germany. Previous research showed that some of the payloads being delivered and the sources of the attacks.
“There is a steady flow of attacks over time and we foresee a significant amount of scanning and such attempts to continue for the time being.” Sharing his insights on the attack attempts, Tushar Richabadas, Senior Product Marketing Manager, Applications and Cloud Security, Barracuda said, “It’s important to take steps to protect your systems. Now is the ideal time to opt for patching, especially if the system is internet-facing. Placing a web application firewall in front of such systems will provide an in-depth defense against zero-day attacks and other vulnerabilities.”
About Barracuda Networks
At Barracuda we strive to make the world a safer place. We believe every business deserves access to cloud-first, enterprise-grade security solutions that are easy to buy, deploy, and use. We protect email, networks, data, and applications with innovative solutions that grow and adapt with our customers’ journey. More than 200,000 organizations worldwide trust Barracuda to protect them – in ways they may not even know they are at risk — so they can focus on taking their business to the next level. For more information, visit barracuda.com.
