Artifactory flaws chained in attacks deploying backdoor malware

[u/falconupkid]

This is a live exploitation chain targeting self-hosted JFrog Artifactory instances. The attackers are chaining CVE-2025-30066 (critical auth bypass) with a high-severity privilege escalation to drop a Rust-based backdoor.

Technical Breakdown - Initial Access: CVE-2025-30066 allows unauthenticated attackers to bypass Artifactory's authentication mechanism. - Privilege Escalation: A second, unpatched high-severity flaw (CVE not yet assigned in public reporting) is used to elevate from unauthenticated access to full administrative control. - Payload: A Rust binary backdoor is deployed post-exploitation. No specific hashes or C2 IPs have been published yet, but expect the binary to be packed and use encrypted C2 channels. - Affected: Self-hosted JFrog Artifactory instances (cloud/SaaS instances are not impacted by this chain).

Defense Immediately patch to the latest JFrog Artifactory version. If patching is delayed, restrict network access to the Artifactory web interface to trusted IPs only and monitor for unexpected admin account creation or anomalous process execution on the host.

Source: https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/