CTI · reported · 2026-09-12

Artifactory flaws chained in attacks deploying backdoor malware

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1195 Supply Chain Compromise Initial Access
• T1078 Valid Accounts Stealth
• T1505 Server Software Component Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: JFrog Artifactory CVE Chain - Admin Account Creation and Plugin Abuse
id: e5f6a7b8-c9d0-1234-efab-345678901234
status: experimental
description: Detects unauthorized admin account creation and Groovy plugin deployment in JFrog Artifactory exploitation
references:
  - https://www.bleepingcomputer.com/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505
logsource:
  product: linux
  category: webserver
detection:
  selection_artifactory_api:
    cs-uri|contains:
      - '/api/system'
      - '/api/security'
      - '/artifactory/api'
    cs-method:
      - POST
      - PUT
  selection_admin_create:
    cs-uri|contains:
      - '/users'
      - '/groups'
      - '/roles'
    cs-uri|contains:
      - 'admin'
  selection_groovy_deploy:
    cs-uri|contains:
      - '/plugins'
      - '/groovy'
    cs-method:
      - POST
  condition: selection_artifactory_api and (selection_admin_create or selection_groovy_deploy)
falsepositives:
  - Legitimate Artifactory administration
level: critical

References

• https://www.bleepingcomputer.com/
• https://dev.to/