Loading story…
An unidentified threat actor compromised an internet-facing Adobe ColdFusion 9 server and deployed Cring ransomware across the victim’s network, according to Sophos. The attacker exploited CVE-2010-2861 to retrieve a password file and apparently used CVE-2009-3960 to upload a payload. Web shells and Cobalt Strike supported continued access and lateral movement, while credential theft, scheduled-task persistence and in-memory script execution helped the attacker obtain Domain Admin privileges and disable endpoint protection.
Approximately 79 hours after initial compromise, the attacker encrypted the server and virtual machine disk images, deleted Volume Shadow Copies and cleared event logs; several other machines were rendered unusable. Sophos recovered evidence from the partially recoverable server, which ran unsupported ColdFusion 9 and Windows Server 2008. The incident underscores the need to retire or isolate unsupported internet-facing systems, restrict administrative privileges and protect backups from deletion or encryption.
See which actors are running it and whether you're in range.
14 events from the most recent confirmed update back to the earliest known activity.
Sophos recovered logs and files from the partially recoverable ColdFusion server and reconstructed the attack by an unidentified threat actor. The investigation found that the internet-facing system ran an 11-year-old Adobe ColdFusion 9 installation on Windows Server 2008.
The attacker deleted Volume Shadow Copies, cleared Windows event logs, and re-enabled the Sophos security products previously disabled. The ransom note appeared as a message on the Windows login screen.
Approximately 79 hours after the initial breach, the attacker executed the ransomware payload msp.exe, encrypting the system and directories containing virtual machine disk images. Cring ransomware was also deployed on other machines in the victim's network, leaving several unusable.
After disabling protection, the attacker discovered a hypervisor and virtual machine disk files on the server. The attacker used PowerShell Get-VM and Stop-VM with the -TurnOff option to forcibly shut down the virtual machines.
Sophos blocked an attempt to load a Cobalt Strike beacon, after which the attacker used the web shell to disable Sophos endpoint protection and Windows Defender. Sophos Tamper Protection was not enabled on the compromised machine.
After another approximately four-hour pause, the attacker profiled the system, obtained Domain Admin privileges, and executed remote commands on other servers. Domain Admin credentials were used to spread Cobalt Strike beacons to additional machines.
The attacker created an account named agent$ with the password P@ssw0rd and granted it administrative permissions.
Approximately five hours later, the attacker used WMIC to invoke PowerShell and download 01.css and 02.css from an IP address geolocated to Belarus.
The attacker installed cfiut.cfm in the ColdFusion /CFIDE/ directory and used it to export the SAM, Security, and System registry hives, which can support credential harvesting. The exports were disguised as PNG files, downloaded from a publicly accessible web directory, and then deleted.
Approximately 62 hours after the initial compromise, the attacker returned through the beacon to upload files and execute commands. A scheduled task invoked wscript.exe with hexadecimal-encoded parameters, while a persistent loader retrieved, decrypted, and executed an additional script in memory.
The attacker wrote a base64-encoded web shell from csa.log to the ColdFusion web directory as cfa.css and used it to attempt to load a Cobalt Strike beacon. The beacon was subsequently used to overwrite the web shell with garbled data to hinder investigation.
The attacker apparently exploited ColdFusion's XML-handling vulnerability CVE-2009-3960 to upload a file through an HTTP POST request to /flex2gateway/amf. Investigators identified a web shell concealed inside a CSS file as a possible payload of this upload.
Approximately three minutes after scanning began, the attacker exploited ColdFusion's directory traversal vulnerability CVE-2010-2861 to retrieve password.properties.
An attacker using an IP address assigned to Ukrainian ISP Green Floid scanned more than 9,000 website paths in 76 seconds. The reconnaissance identified ColdFusion-specific administrative and login paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised an internet-facing **Adobe ColdFusion 9** server on **Windows Server 2008** and deployed **Cring ransomware** after exploiting the long-known vulnerabilities `CVE-2010-2861` and `CVE-2009-3960`. The intrusion began with retrieval of sensitive files and upload of a web shell, then expanded into persistence, credential theft, and lateral movement as the operators worked toward **Domain Admin** privileges. Sophos said the attackers also used additional web shells, **Cobalt Strike**, scheduled tasks, **WMIC**, and **PowerShell** during the intrusion. The operators attempted to evade detection by deleting logs, overwriting artifacts, and disabling **Sophos endpoint protection** and **Windows Defender**. They stole registry hives, created an administrative account, shut down hosted virtual machines, deleted **Volume Shadow Copies**, and encrypted both the compromised server and VM disk files roughly 79 hours after the initial breach. The case underscores the exposure created by leaving public-facing, end-of-life systems unpatched, as both **ColdFusion 9** and **Windows Server 2008** were unsupported at the time of the attack.
Aug 15, 2026
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process `w3wp.exe` to run reconnaissance and deploy multiple steganographic webshells, including `UA4fp7R.aspx` and `WRBYTR5750images.aspx`. Huntress reported the intruder embedded the marker **ONEPIECE** in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete. The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling `WDigest` `UseLogonCredential`, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Jul 2, 2026
Attackers are actively exploiting **CVE-2026-48282**, a maximum-severity Adobe ColdFusion path-traversal vulnerability rated **CVSS 10.0**. The flaw permits unauthenticated arbitrary file writes that can lead to remote code execution when Remote Development Services (RDS) is enabled with RDS authentication disabled—a non-default configuration. Adobe released patches on June 30, 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 7 following exploitation reports and a Canadian Centre for Cyber Security warning. CrowdSec first observed exploitation on July 20 and recorded 107 attacking IP addresses; separate telemetry cited by Previdian recorded 272 attempts across 16 sensors. **ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21** address this flaw and the related arbitrary-file-read vulnerability **CVE-2026-48313**, which CrowdSec also reports is being exploited. Organizations should prioritize patching exposed ColdFusion servers, verify whether RDS is enabled without authentication, and investigate potentially affected systems for unauthorized file writes and execution. Citrix released NetScaler Web App Firewall signatures version 183 to help mitigate exploitation, but these protections should supplement rather than replace patching. CrowdSec characterized the observed campaign as rapidly reaching Early Exploitation before settling into Limited Exploitation.
Oct 9, 2026