JFrog Artifactory Zero-Day Chain (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329): In-the-Wild Exploitation Drops Rust Backdoor via log.gitclone.org C2 — OTX Detection Pack

---
title: JFrog Artifactory Exploitation - Suspicious Groovy Plugin Execution and Child Processes
id: 3f7a2c1e-9b4d-4e6f-a8c2-20261011art1
status: experimental
description: Detects the Artifactory Java process spawning suspicious child processes (shells, scripting engines, curl/wget), consistent with post-exploitation activity via malicious Groovy plugins deployed through CVE-2026-82329.
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
date: 2026/10/11
modified: 2026/10/11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
  definition: 'Also applicable to Linux via auditd/sysmon-for-linux process creation events'
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '/java'
    ParentCommandLine|contains:
      - 'artifactory'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/python'
      - '/usr/bin/perl'
  condition: selection_parent and selection_children
falsepositives:
  - Legitimate Artifactory Groovy plugins performing administrative automation
  - Build integration scripts invoking external tools
level: high
---
title: Rust Backdoor C2 - Outbound Connection to log.gitclone.org or Port 45678
id: 8d1e4b2a-6c3f-4a9d-b7e5-20261011art2
status: experimental
description: Detects DNS resolution or outbound network connections to the Rust backdoor C2 domain log.gitclone.org, or HTTP traffic to non-standard port 45678 with the /smtp URI path, as observed in the Artifactory exploitation campaign.
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
date: 2026/10/11
modified: 2026/10/11
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1571
logsource:
  category: network_connection
  product: windows
  definition: 'Map equivalent fields for Linux (Sysmon for Linux Event ID 3) and Zeek/Suricata network logs'
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'gitclone.org'
  selection_port:
    DestinationPort: 45678
  condition: selection_domain or selection_port
falsepositives:
  - Unlikely; port 45678 is not associated with common enterprise services
level: critical
---
title: Artifactory Anonymous Token Abuse - Authentication Anomaly Indicating CVE-2026-42018/42016 Exploitation
id: 5c9b3d7f-2a8e-4f1c-96d4-20261011art3
status: experimental
description: Detects administrative API operations or Groovy plugin uploads performed under anonymous or low-privilege token contexts in Artifactory access/request logs, indicating token disclosure (CVE-2026-42018) followed by privilege escalation (CVE-2026-42016).
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
date: 2026/10/11
modified: 2026/10/11
tags:
  - attack.privilege_escalation
  - attack.t1078
  - attack.persistence
  - attack.t1505
logsource:
  product: jfrog
  service: artifactory
  definition: 'Ingest Artifactory request.log and access.log via filebeat or syslog forwarder'
detection:
  selection_admin_paths:
    uri_path|contains:
      - '/api/plugins'
      - '/api/system/configuration'
      - '/api/security/users'
      - '/api/security/permissions'
      - '/api/system/liquidation'
  selection_anon:
    authenticated_user:
      - 'anonymous'
      - '_anonymous'
      - 'non_authenticated_user'
  selection_method:
    http_method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
      - 'PATCH'
  condition: selection_admin_paths and selection_anon and selection_method
falsepositives:
  - Misconfigured CI integrations using anonymous access for read-only operations (writes should never occur)
level: critical

// Microsoft Sentinel: Hunt for Artifactory exploitation and Rust backdoor C2
// Covers: hash match, C2 network indicators, and suspicious child processes of Java/Artifactory
let BackdoorHashes = dynamic([
    "6639abda5778b31cc049e4af0a71da04750fafda97d44eec3dd202d32e3e2496",
    "513a907b69edffc3cb77a494da395178d21ef9bd",
    "ac6c52632fcf8b072be3b1c5bc076fdd"
]);
let C2Domain = "log.gitclone.org";
let C2Port = 45678;
let Lookback = 90d;
let HashHits = union isfuzzy=true
    (DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in (BackdoorHashes) or SHA1 in (BackdoorHashes) or MD5 in (BackdoorHashes)
    | project HitType="FileHash", TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine),
    (DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in (BackdoorHashes) or SHA1 in (BackdoorHashes) or MD5 in (BackdoorHashes)
    | project HitType="EventHash", TimeGenerated, DeviceName, FolderPath="", FileName, SHA256, InitiatingProcessCommandLine);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has C2Domain or RemoteIP in (todynamic("[]")) or RemotePort == C2Port
    | where RemoteUrl has "gitclone.org" or RemotePort == C2Port
    | project HitType="C2Network", TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "java" or InitiatingProcessCommandLine has "artifactory"
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","wget.exe","certutil.exe","sh","bash","curl","wget","python","python3","perl")
    | project HitType="ArtifactoryChildProc", TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName;
union HashHits, NetworkHits, ProcessHits
| sort by TimeGenerated desc

# Security Arsenal - Artifactory Exploit Chain & Rust Backdoor Hunt Script
# Run on Artifactory hosts and adjacent infrastructure. Requires admin for full coverage.

$Report = @()

# 1) File hash hunt for the Rust backdoor
$TargetSHA256 = "6639abda5778b31cc049e4af0a71da04750fafda97d44eec3dd202d32e3e2496"
$TargetMD5    = "ac6c52632fcf8b072be3b1c5bc076fdd"
$SearchPaths  = @("C:\Program Files\JFrog","C:\opt","/opt/jfrog","/var/opt/jfrog","$env:TEMP","C:\Users\Public","/tmp","/var/tmp","/dev/shm")

Write-Host "[1/5] Hash hunt for Rust backdoor..." -ForegroundColor Cyan
foreach ($p in $SearchPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $h = Get-FileHash -Algorithm SHA256 -Path $_.FullName -ErrorAction Stop
                if ($h.Hash -eq $TargetSHA256) {
                    $Report += [pscustomobject]@{Check="BackdoorSHA256"; Finding="MATCH: $($_.FullName)"; Severity="CRITICAL"}
                }
            } catch {}
        }
    }
}

# 2) Network connections to C2 (domain + port 45678)
Write-Host "[2/5] Checking active/historical network connections to C2..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemotePort -eq 45678 }
foreach ($c in $conns) {
    $Report += [pscustomobject]@{Check="C2Port45678"; Finding="PID $($c.OwningProcess) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"; Severity="CRITICAL"}
}
try {
    $dns = Resolve-DnsName -Name "log.gitclone.org" -ErrorAction Stop
    $Report += [pscustomobject]@{Check="C2DNS"; Finding="log.gitclone.org resolves from this host: $($dns.IPAddress -join ',')"; Severity="HIGH"}
} catch {}

# 3) Suspicious Artifactory Groovy plugins (Linux + Windows paths)
Write-Host "[3/5] Auditing Artifactory Groovy plugins..." -ForegroundColor Cyan
$PluginDirs = @("/var/opt/jfrog/artifactory/etc/artifactory/plugins",
                "/opt/jfrog/artifactory/var/etc/artifactory/plugins",
                "C:\JFrog\artifactory\var\etc\artifactory\plugins")
foreach ($d in $PluginDirs) {
    if (Test-Path $d) {
        $cutoff = (Get-Date).AddDays(-60)
        Get-ChildItem -Path $d -Filter "*.groovy" -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff } | ForEach-Object {
                $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                $suspicious = $content -match "Runtime\.getRuntime|ProcessBuilder|exec\(|Socket|URLConnection|HttpClient|downloadString"
                $sev = if ($suspicious) { "CRITICAL" } else { "MEDIUM" }
                $Report += [pscustomobject]@{Check="GroovyPlugin"; Finding="$($_.FullName) modified $($_.LastWriteTime) | SuspiciousAPIs=$suspicious"; Severity=$sev}
            }
    }
}

# 4) Persistence: scheduled tasks, cron, systemd referencing java/unknown binaries
Write-Host "[4/5] Checking persistence mechanisms..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "45678|gitclone|/tmp/|/dev/shm|powershell -enc|curl |wget ") {
        $Report += [pscustomobject]@{Check="ScheduledTask"; Finding="$($_.TaskName): $($actions.Trim())"; Severity="HIGH"}
    }
}
foreach $cronf in @("/etc/crontab","/var/spool/cron") {
    if (Test-Path $cronf) {
        $hits = Select-String -Path $cronf -Pattern "45678|gitclone|/dev/shm|curl|wget" -ErrorAction SilentlyContinue
        foreach ($h in $hits) { $Report += [pscustomobject]@{Check="Cron"; Finding="$($h.Path): $($h.Line)"; Severity="HIGH"} }
    }
}

# 5) Artifactory log review for anonymous admin actions (CVE-2026-42018/42016)
Write-Host "[5/5] Scanning Artifactory request logs for anonymous admin API access..." -ForegroundColor Cyan
$LogPaths = @("/var/opt/jfrog/artifactory/var/log/request.log",
              "/opt/jfrog/artifactory/var/log/request.log",
              "C:\JFrog\artifactory\var\log\request.log")
foreach $lp in $LogPaths) {
    if (Test-Path $lp) {
        Select-String -Path $lp -Pattern "(anonymous|non_authenticated).*(/api/plugins|/api/system|/api/security)" -ErrorAction SilentlyContinue |
            Select-Object -First 50 | ForEach-Object {
                $Report += [pscustomobject]@{Check="AnonAdminAPI"; Finding="$($_.LineNumber): $($_.Line.Substring(0,[Math]::Min(200,$_.Line.Length)))"; Severity="CRITICAL"}
            }
    }
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Report.Count -eq 0) { Write-Host "No indicators found on this host." -ForegroundColor Green }
else { $Report | Sort-Object Severity | Format-Table -AutoSize | Out-String -Width 250 | Write-Host }
$Report | Export-Csv -Path ".\artifactory_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation