Spike in Atlassian Exploitation Attempts: Patching is Crucial | Grey Noise Blog

Summary: GreyNoise detected a sudden increase in malicious Atlassian exploitation attempts late last week after changing how its back-end calculates hourly trending and anomalous events, with Atlassian-related topics occupying seven of the top ten trending tag anomalies at the time of writing. Analysis of the past 24 hours found the highest number of overlapping IPs across the affected tags was only 9, and 67% of the total IPs were seen only once, indicating a fair distribution of IPs trying different vulnerabilities rather than a few sources scanning for all of them.
What you should know: With 67% of the attacking IPs seen only once, blocklists and repeat-offender tracking will miss most of this activity, so unpatched Atlassian products exposed to the public internet face opportunistic mass exploitation that GreyNoise says is likely too late to avoid once compromise occurs.

Read the original at GreyNoise Blog ↗