AtomSilo Ransomware – Reverse Engineering Analysis (RSA-512 + AES hybrid encryption) and Confluence CVE-2021-26084 / DLL Side-Loading Intrusion Chain

Key facts for AtomSilo ransomware

Detection coverage for AtomSilo ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5288 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AtomSilo Post-Exploitation — mfeann.exe DLL Side-Loading with mfc.ini Payload

Detects execution of the signed McAfee component mfeann.exe outside McAfee directories (or from user-writable paths even when the folder name imitates McAfee), unsigned DLLs loaded by it, and creation of mfc.ini. Sophos observed AtomSilo operators side-loading a malicious DLL via mfeann.exe that decrypted the encrypted mfc.ini payload into a Cobalt Strike-like backdoor (T1574.001/T1574.002 side-loading, T1036.005 trusted-name masquerade, T1140 payload decoding).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.001, T1574.002, T1036.005, T1140
• Data sources: sysmon, microsoft_defender_for_endpoint:DeviceProcessEvents, microsoft_defender_for_endpoint:DeviceImageLoadEvents, process_creation, file_event
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 Image="*mfeann.exe") OR (EventCode=7 Image="*mfeann.exe" Signed=false) OR (EventCode=11 TargetFilename="*mfc.ini"))
| eval signal=case(EventCode=1,"mfeann_exec",EventCode=7,"unsigned_dll_loaded_by_mfeann",EventCode=11,"mfc_ini_written"), in_mcafee_path=if(like(Image,"%McAfee%"),1,0), user_writable=if(match(lower(Image),"users|temp|programdata|public"),1,0)
| where in_mcafee_path=0 OR user_writable=1
| stats count values(signal) as signals values(ImageLoaded) as dlls_loaded values(TargetFilename) as files values(CommandLine) as command_lines min(_time) as first_seen by host, User, Image
| eval first_seen=strftime(first_seen,"%F %T")

Microsoft KQL

union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "mfeann.exe"
 | where FolderPath !has "McAfee" or FolderPath has_any ("\\Users\\", "\\Temp\\", "\\ProgramData\\", "\\Public\\")
 | project Timestamp, DeviceName, Account = AccountName, Signal = "mfeann_exec", Path = FolderPath, Detail = ProcessCommandLine),
(DeviceImageLoadEvents
 | where Timestamp > ago(24h)
 | where InitiatingProcessFileName =~ "mfeann.exe"
 | where InitiatingProcessFolderPath !has "McAfee" or FolderPath !has "McAfee"
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "mfeann_dll_load", Path = FolderPath, Detail = FileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "mfc.ini" and ActionType == "FileCreated"
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "mfc_ini_drop", Path = FolderPath, Detail = InitiatingProcessFileName)
| order by Timestamp desc

Sigma

title: McAfee mfeann.exe Executed Outside McAfee Directory - DLL Side-Loading
id: 0c7d9a52-3e18-4b6f-a1d4-52f8c9e07b13
status: experimental
description: Detects mfeann.exe running from a path that is not a McAfee install directory, or from a user-writable path. AtomSilo operators abused this signed binary to side-load a malicious DLL that decrypted the mfc.ini backdoor payload (TL-2026-5288).
references:
  - https://www.sophos.com/en-us/blog/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.t1574.002
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mfeann.exe'
  filter_mcafee:
    Image|contains: 'McAfee'
  selection_writable:
    Image|contains:
      - '\Users\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Public\'
  condition: selection and (not filter_mcafee or selection_writable)
falsepositives:
  - Portable or relocated McAfee VirusScan Enterprise installations
level: high
---
title: AtomSilo Encrypted Backdoor Payload mfc.ini Created
id: b4d6f8a0-2c3e-4d5a-9f71-8a0c2e4b6d93
status: experimental
description: Detects creation of mfc.ini, the encrypted payload that the DLL side-loaded by mfeann.exe decrypts into a Cobalt Strike-like backdoor in the AtomSilo intrusion (TL-2026-5288).
references:
  - https://www.sophos.com/en-us/blog/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.defense_evasion
  - attack.t1140
  - attack.t1574.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\mfc.ini'
  filter_mcafee:
    Image|contains: 'McAfee'
  condition: selection and not filter_mcafee
falsepositives:
  - Unrelated applications that legitimately use an mfc.ini configuration file
level: medium

Known false positives:

• Relocated or portable McAfee VirusScan Enterprise deployments running mfeann.exe from a non-standard path
• Software packaging or lab environments that stage McAfee binaries in temporary directories
• Unrelated applications that use a configuration file named mfc.ini

Tuning notes: The user-writable-path branch catches attackers who stage the binary in a folder containing the word McAfee. Allowlist your managed McAfee install paths and hash the legitimate mfeann.exe (SHA256 07bbd8a80b5377723b13dbb40a01ca44cbc203369f5e5652a25b448e27ca108c was reported by Sophos) for exact matching. Sysmon event 7 (image load) with Signed=false needs the ImageLoad rule enabled for the mfeann.exe process. Correlate hits with a preceding Confluence exploitation alert (SPL-001) on the same host.

• 🔒 AtomSilo Lateral Execution — wmiexec-Style WMI Commands and [indicator]/[indicator] Discovery · unlock with TL Creds
• 🔒 AtomSilo Defense Evasion — Kernel Driver Utility ([indicator] / [indicator]) Used to Disable Endpoint Protection · unlock with TL Creds
• 🔒 AtomSilo Exfiltration — Rclone Data Copy to Dropbox · unlock with TL Creds
• 🔒 AtomSilo Ransomware Encryption Artifacts — [indicator] Files and README-FILE HTA Ransom Notes · unlock with TL Creds
• 🔒 AtomSilo Domain-Wide Deployment — 'Update' Service, Scheduled Task and GPO Scheduled-Task Push · unlock with TL Creds
• 🔒 AtomSilo Lateral Movement — RDP Logons with Compromised Administrative Credentials · unlock with TL Creds
• 🔒 AtomSilo Initial Access — Confluence CVE-2021-26084 OGNL Injection and Confluence-Spawned Shell · unlock with TL Creds
• 🔒 AtomSilo C2 and Ransomware Contact Infrastructure Connections · unlock with TL Creds

Indicators of compromise for AtomSilo ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5288.

Sample indicators (3 of 27)

• IP address: 139.180.184[.]147
• Domain: update[.]ajaxrenew[.]com
• File hash: 7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How AtomSilo ransomware works

AtomSilo (also written Atom Silo) is a 64-bit Windows ransomware written with the CryptoPP library. Reverse engineering by Chuong Dong (2021-10-13) shows it creates a run-once mutex (CreateMutexA, name 8d5e957f297893487bd98fa830fa6413), generates a per-victim RSA-512 key pair, and spawns encryption threads for drives A-Z. Directories are walked depth-first; files are memory-mapped (CreateFileMappingA/MapViewOfFile) and encrypted with a random 32-character AES key per file. The AES key is encrypted with the victim RSA key and appended to the end of the file (0x210 bytes); the victim public key is in turn encrypted with AtomSilo's hardcoded RSA public key and embedded in the ransom note. Encrypted files receive the .ATOMSILO extension. Cyfirma describes selective block encryption (XOR and AES) and SentinelOne describes a partial-encryption model similar to LockBit and its offshoots.

The sample skips the directories Boot, Windows, Windows.old, Tor Browser, Internet Explorer, Google, Opera, Opera Software, Mozilla, Mozilla Firefox, $Recycle.Bin, ProgramData and All Users; skips files such as autorun.inf, index.html, boot.ini, bootmgr, desktop.ini, iconcache.db, ntldr, ntuser.dat, thumbs.db; and skips the extensions .atomsilo, .hta, .html, .exe, .dll, .cpl, .ini, .cab, .cur, .drv, .hlp, .icl, .icns, .ico, .idx, .sys, .spl and .ocx. Ransom notes are written as index.html in directories that contain .php/.asp/.jsp/.html files and as README-FILE-[Computer Name]-[Timestamp].hta elsewhere. The note embeds the encrypted key in <asf>, <csf> and <bsf> tags, demands USD 1,000,000 (reduced by half within 48 hours), gives the contact arvato@atomsilo.com plus a Tor site, and sets a 5-day deadline. The analyzed sample itself shows no shadow-copy deletion or service termination, although SentinelOne reports process/service termination and self-deletion in other builds.

Sophos MTR Rapid Response investigated an intrusion in which the operators exploited Atlassian Confluence CVE-2021-26084 (OGNL injection) on 2021-09-13, dropped a backdoor, moved laterally to multiple servers within about five hours using compromised administrative credentials and WMI execution resembling SecureAuthCorp's wmiexec, and ran discovery via logs.bat. A signed, DLL-hijack-vulnerable McAfee VirusScan Enterprise component (mfeann.exe) was used to side-load a malicious DLL decrypted from mfc.ini, yielding a Cobalt Strike-like backdoor. On 2021-09-24 the actors used RDP, ran Rclone to copy data to a Dropbox account, used a Kernel Driver Utility hacktool (autologin.exe, autologin.sys, drv64.dll) to disable Sophos file-scanning services, and deployed the ransomware (autoupdate.exe) across domain controllers using batch files, a service named 'Update', scheduled-task XML and Group Policy. Sophos assessed the ransomware as virtually identical to LockFile, with ransom 'rules' resembling DarkSide/BlackMatter; the operators are either new or a rebrand. No named actor, nation-state or CVE-specific attribution is stated in any source. SentinelOne also reports spearphishing attachments as an alternate delivery route.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Execution

T1047 Windows Management Instrumentation; T1059.003 Command and Scripting Interpreter: Windows Command Shell

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1070.004 Indicator Removal: File Deletion; T1574.001 DLL; T1622 Debugger Evasion

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment

defense-impairment

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools

Impact

T1489 Service Stop

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Remediation for AtomSilo ransomware

Patches

• Apply Atlassian fixed releases for CVE-2021-26084

Immediate actions

• Patch Atlassian Confluence against CVE-2021-26084 and hunt Confluence servers for OGNL-injection webshell/backdoor artifacts
• Block 139.180.184.147 and update.ajaxrenew.com at the perimeter and alert on any traffic to them
• Hunt for mutex 8d5e957f297893487bd98fa830fa6413, .ATOMSILO files and README-FILE-*.hta / index.html ransom notes
• Hunt for mfeann.exe loaded from non-McAfee paths alongside mfc.ini, and for autologin.sys/drv64.dll driver loads
• Alert on Rclone execution and uploads to Dropbox from servers

Workarounds

• Restrict internet exposure of Confluence until patched
• Application-allowlist signed binaries that are known DLL side-loading hosts

Longer-term hardening

• Enable tamper protection on endpoint security and block known-vulnerable driver loading
• Restrict WMI/RDP lateral movement and monitor new services (e.g. 'Update'), scheduled tasks and GPO changes
• Maintain offline, immutable backups and test restores
• Expose collaboration servers only through hardened, monitored access paths

Affected and fixed versions

• Microsoft — Windows (all versions; 64-bit executable, drives A-Z)
  Vulnerable versions: Windows systems where the payload executes
• Atlassian — Confluence Server / Data Center (initial access vector, CVE-2021-26084)
  Vulnerable versions: Versions prior to the fixed releases in the Atlassian advisory
  Fixed in: See Atlassian advisory for CVE-2021-26084
• McAfee — VirusScan Enterprise component mfeann.exe (abused for DLL side-loading)
  Vulnerable versions: Version abused in the Sophos-investigated intrusion

Timeline of AtomSilo ransomware

• 2021-08-25 Atlassian Confluence OGNL injection vulnerability CVE-2021-26084 is publicly disclosed (about three weeks before the observed locked-ioc-24 intrusion).
• 2021-09-13 Per Sophos MTR, operators compromise a Confluence server via OGNL injection and establish backdoor access; lateral movement to multiple servers follows within roughly five hours using admin credentials and WMI.
• 2021-09-16 Around day 3 of the intrusion, locked-ioc-23 collects security logs and network information; an unrelated cryptocurrency miner is also implanted (Sophos).
• 2021-09-24 Compilation date of the analyzed locked-ioc-24 sample reported by CYFIRMA.
• 2021-09-24 Operators use RDP, run locked-ioc-27 to copy data to Dropbox, disable endpoint protection with a Kernel Driver Utility hacktool, and deploy locked-ioc-24 ransomware across domain controllers (Sophos).
• 2021-10-05 Anti-Malware.ru reports locked-ioc-24 ransomware arriving via a Confluence server vulnerability.
• 2021-10-06 Sophos and Infosecurity Magazine publish the Atom Silo Confluence exploit and DLL side-loading analysis, noting near-identity with locked-ioc-25.
• 2021-10-13 Chuong Dong publishes a full reverse-engineering analysis detailing the RSA-512 + AES scheme, mutex, exclusion lists and ransom note formats.

Sources cited for AtomSilo ransomware

• NVD - CVE-2021-26084 NVD (NIST) · Advisory
• AtomSilo Ransomware Analysis - Chuong Dong chuongdong.com · Research · 2021-10-13
• Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack - Sophos Sophos · Vendor report · 2021-10-06
• Malware Research on AtomSilo Ransomware - CYFIRMA cyfirma.com · Research
• AtomSilo Ransomware: In-Depth Analysis, Detection, Mitigation, and Removal - SentinelOne SentinelOne · Vendor report
• Detecting Atom Silo Ransomware Infections - SOC Prime socprime.com · Blog
• Atom Silo Uses DLL Side-Loading to Deploy Ransomware - Infosecurity Magazine infosecurity-magazine.com · News · 2021-10-06
• New Atom Silo Ransomware Group Targets Confluence Servers - Dark Reading Dark Reading · News
• AtomSilo ransomware arrives through a Confluence server hole - Anti-Malware.ru anti-malware.ru · News · 2021-10-05
• Atom Silo exploits a recent Confluence vulnerability to deploy ransomware - Cybersecurity-Help cybersecurity-help.cz · News

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Previous and next in ransomware

• DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64) Previous report
• BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass) Next report