Cybercriminals Sneak in Crypto Mining Malware via Confluence Software Exploit

Cybercriminals are now reportedly exploiting known vulnerability CVE-2019-3396 in the software Confluence, a workspace productivity tool made by Atlassian, according to a report by security intelligence firm Trend Micro Inc. on May 7.

The exploit that has been developed allows cybercriminals to stealthily install and run a monero (XMR) miner on a vulnerable computer, as well as covering up the mining activity by using a rootkit to hide the malware’s network activity and toll on the host’s central processing unit (CPU).

According to an Atlassian security advisory, the vulnerability in question only applies to some older versions of Confluence. The vulnerability can be avoided by downloading patched versions of Confluence Server and Data Center.

In February, as previously reported by Cointelegraph, Trend Micro covered another instance of XMR miner malware attacks. This attack targeted Microsoft Windows users with the Windows exploit tool mimikatz and remote control program Radmin. The vulnerability targeted was Windows SMB Server Vulnerability MS17-010, which has since been patched in 2017.

Crypto mining attacks are purportedly on the rise, according to a statement by AT&T Cybersecurity in March. Per the report, online shopping giant Amazon has also been the victim of a monero miner attack. In this case, the attack was executed on a Kubernetes server operating inside Amazon Web Services.