Just a heads up: On March 24, 2025, starting at 4:30pm CDT / 19:30 UTC, the site will be undergoing scheduled maintenance for a few hours. During this time, the site might be unavailable for a short while. Thanks for your patience.

×
Create
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Product Q&A
See all
Community resources
Top groups
Explore all groups
Community resources
Learn
Community resources
Events
Community resources

Ransomware attack

Matthew Furry
Matthew Furry
Contributor
June 5, 2022

We were too slow to patch (and don't have maintenance) and our Confluence on-prem is now locked up.  I've stopped the thread that was encrypting, but it looks like backups were deleted and attachments encrypted.  

Any experiences so far in the community?

Answer
Watch
Like Be the first to like this
1283 views

4 answers

1 vote
Mayur Jadhav
Mayur Jadhav
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
Become a leader
June 5, 2022

I think multiple instances got affected by this vulnerability, some observations are like, home directory is missing, couple of files are locked, random users were created with Admin privileges. 

Reply
0 votes
Mayur Jadhav
Mayur Jadhav
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
Become a leader
June 8, 2022

Hi Santosh,

It would be good if you have the backup, would suggest to to create new instance and restore the backup. May be they downloaded not sure about this. Atlassian is trying to mitigate the problem. 

Reply
0 votes
Santhosh
Santhosh
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Get involved
June 8, 2022

@Mayur Jadhav Do you think there is a home folder download? or it is just remote code execution to prevent use of confluence server?

Reply
0 votes
Santhosh
Santhosh
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Get involved
June 5, 2022

I have faced the same issue here.. not sure if the whole home folder got downloaded by the hacker...I keep taking weekly backups and found not much data loss for me so far.. 

Reply

Suggest an answer

Log in or Sign up to answer
Confluence
Confluence
TAGS
AUG Leaders

Atlassian Community Events

    See all events