Smash!Malware
RansomwareFrom MISP Galaxy
Last reported 18 days ago, by watchTowr Labs2 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)“Smash through the Atlassian documentation.”
-
Effective Patch Management Strategies: 7 Best Practices“Vulnerabilities keep coming, and they don't stop coming (or whatever Smash Mouth said), environments keep changing, and the attackers looking for gaps in your patch management strategy aren't slowing down.”
Indicators in its reports
named in the reports above- router[.]javain 1 report
- resourcename[.]mapin 1 report
- hxxp://java.sun[.]com/xml/ns/javaeein 1 report
- hxxp://java.sun[.]com/xml/ns/javaee/web-app_3_0.xsdin 1 report
- hxxp://www.atlassian[.]com/software/jirain 1 report
- crowd[.]propertiesin 1 report
- application[.]namein 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.