CTI · reported · 2026-09-12

JFrog Artifactory under active attack with CVE chain exploit

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1078 Valid Accounts Stealth
• T1195 Supply Chain Compromise Initial Access
• T1505 Server Software Component Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: JFrog Artifactory CVE Chain Exploitation and Admin Account Creation
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: Detects exploitation of JFrog Artifactory CVE chain including unauthorized admin account creation and malicious Groovy plugin deployment
references:
  - https://www.bleepingcomputer.com/
  - https://threatnoir.com/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505
logsource:
  product: linux
  category: process_creation
detection:
  selection_artifactory_admin_create:
    Image|contains:
      - 'artifactory'
    CommandLine|contains:
      - 'createUser'
      - 'admin'
      - 'role'
  selection_groovy_plugin:
    Image|contains:
      - 'artifactory'
    CommandLine|contains:
      - 'groovy'
      - 'plugin'
      - 'install'
  selection_reverse_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
    CommandLine|contains:
      - '/dev/tcp'
      - 'nc -e'
      - 'ncat'
      - 'python -c'
      - 'perl -e'
  condition: selection_artifactory_admin_create or selection_groovy_plugin or selection_reverse_shell
falsepositives:
  - Legitimate Artifactory administration operations
level: critical

YARA-X raw

import "pe"

rule JFrog_Artifactory_Rust_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026-09-12"
        status = "experimental"
        description = "Detects Rust-based backdoor deployed during JFrog Artifactory CVE chain exploitation"
        reference = "https://www.bleepingcomputer.com/"
        falsepositives = "Unknown"

    strings:
        $rust = "GoRust" ascii
        $rust2 = "rust-cargo" ascii nocase
        $artifactory = "artifactory" ascii nocase
        $groovy = "groovy" ascii nocase
        $reverse = "/dev/tcp" ascii
        $reverse2 = "ncat" ascii
        $shell = "/bin/sh" ascii
        $shell2 = "/bin/bash" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 50MB and
        ($rust or $rust2) and
        1 of ($artifactory, $groovy) and
        1 of ($reverse, $reverse2, $shell, $shell2)
}

References

• https://www.bleepingcomputer.com/
• https://threatnoir.com/
• https://gbhackers.com/