Hackers exploit Confluence vulnerability to conduct mining attacks

Cybercriminals are exploiting a known vulnerability, CVE-2019-3396, in Confluence, an office software produced by Atlassian, to conduct cryptocurrency mining attacks, according to a May 7 report from security intelligence firm Trend Micro.

The vulnerability allows cybercriminals to secretly install and run Monero (XMR) mining software on vulnerable computers and mask the mining activity by using a rootkit to hide the malware's network activity.

According to a security advisory from Atlassian, the vulnerability applies only to certain older versions of Confluence and can be fixed by downloading patched versions of Confluence Server and Data Center.

In February, Trend Micro reported another attack using Monero (XMR) mining malware. This time it targeted Microsoft Windows users using the Windows exploit tool mimikatz and the remote control program Radmin to target the Windows SMB Server vulnerability MS17-010, which was fixed in 2017.

According to a cybersecurity statement released by AT&T in March, the number of crypto mining attacks is on the rise. Online shopping giant Amazon has also reportedly become a victim of a Monero mining attack. Hackers used Kubernetes servers running inside Amazon Web Services to mine.