Ransomware attack

[Matthew Furry]

We were too slow to patch (and don't have maintenance) and our Confluence on-prem is now locked up.  I've stopped the thread that was encrypting, but it looks like backups were deleted and attachments encrypted.  

Any experiences so far in the community?

[Mayur Jadhav]

I think multiple instances got affected by this vulnerability, some observations are like, home directory is missing, couple of files are locked, random users were created with Admin privileges. 

[Mayur Jadhav]

Hi Santosh,

It would be good if you have the backup, would suggest to to create new instance and restore the backup. May be they downloaded not sure about this. Atlassian is trying to mitigate the problem. 

[Santhosh]

@Mayur Jadhav Do you think there is a home folder download? or it is just remote code execution to prevent use of confluence server?

[Santhosh]

I have faced the same issue here.. not sure if the whole home folder got downloaded by the hacker...I keep taking weekly backups and found not much data loss for me so far..