Threat Source newsletter (June 9, 2022) — Get ready for Cisco Live
Summary: Cisco Talos reported that attackers are actively exploiting a zero-day in Atlassian Confluence Data Center and Server to run remote code, delivering payloads including the in-memory BEHINDER implant and web shells such as China Chopper, with a proof of concept now available and continued exploitation confirmed. Talos also noted ongoing exploitation of the Follina vulnerability in Microsoft Support Diagnostic Tool to deliver Qbot, AsyncRAT and other malware, with no official patch available and Office Pro Plus, 2013, 2016, 2019 and 2021 confirmed affected.
Why it matters: Atlassian has shipped patches (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1), but many Confluence instances remain unpatched while attackers scan for them and a public proof of concept is now in the wild.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026