Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
80
Malware
Cerber
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest firstCampaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
22
Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
26
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
36
Related CVEs
by mentions- CVE-2022-26134100%9.8Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
Appears with
- Palo Alto Networksvendor · 5
- Palo Alto Networksorganization · 4
- AutoFocusproduct · 3
- Ursnifmalware · 2
- Gootkitmalware · 2
- EITestthreat actor · 2
- Rig EKmalware · 2
- CryptFile2malware · 1
- Trapsproduct · 1
- Cortex Xpanseproduct · 1
- Empire Packmalware · 1
- CryptoMixmalware · 1
- pseudo-Darkleechthreat actor · 1
- Angler EKmalware · 1
- Atlassian Confluence Serverproduct · 1
- Latentbotmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.