Ransomware attack

Question

We were too slow to patch (and don't have maintenance) and our Confluence on-prem is now locked up.  I've stopped the thread that was encrypting, but it looks like backups were deleted and attachments encrypted.

Any experiences so far in the community?

Mayur Jadhav_30osel · Answer

Hi Santosh,

It would be good if you have the backup, would suggest to to create new instance and restore the backup. May be they downloaded not sure about this. Atlassian is trying to mitigate the problem.

Santhosh_3ja082 · Answer

@Mayur Jadhav Do you think there is a home folder download? or it is just remote code execution to prevent use of confluence server?

Mayur Jadhav_30osel · Answer

I think multiple instances got affected by this vulnerability, some observations are like, home directory is missing, couple of files are locked, random users were created with Admin privileges.