# AtomSilo Ransomware – Reverse Engineering Analysis (RSA-512 + AES hybrid encryption) and Confluence CVE-2021-26084 / DLL Side-Loading Intrusion Chain

> AtomSilo is a Windows ransomware (RaaS-style, multi-extortion) first seen in September 2021 that encrypts files with a hybrid RSA-512 and per-file 32-byte AES scheme and appends .ATOMSILO. Sophos observed operators gaining access via Atlassian Confluence CVE-2021-26084 (OGNL injection), side-loading a DLL via a vulnerable McAfee executable, disabling endpoint protection with a kernel driver, and exfiltrating data with Rclone to Dropbox before deployment.

- **Published:** 2026-11-05T02:34:24Z
- **Last reviewed:** 2026-11-05T02:34:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5288
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5288.png
- **ID:** TL-2026-5288
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)
- **CVEs:** CVE-2021-26084

## Description

AtomSilo (also written Atom Silo) is a 64-bit Windows ransomware written with the CryptoPP library. Reverse engineering by Chuong Dong (2021-10-13) shows it creates a run-once mutex (CreateMutexA, name 8d5e957f297893487bd98fa830fa6413), generates a per-victim RSA-512 key pair, and spawns encryption threads for drives A-Z. Directories are walked depth-first; files are memory-mapped (CreateFileMappingA/MapViewOfFile) and encrypted with a random 32-character AES key per file. The AES key is encrypted with the victim RSA key and appended to the end of the file (0x210 bytes); the victim public key is in turn encrypted with AtomSilo's hardcoded RSA public key and embedded in the ransom note. Encrypted files receive the .ATOMSILO extension. Cyfirma describes selective block encryption (XOR and AES) and SentinelOne describes a partial-encryption model similar to LockBit and its offshoots.

The sample skips the directories Boot, Windows, Windows.old, Tor Browser, Internet Explorer, Google, Opera, Opera Software, Mozilla, Mozilla Firefox, $Recycle.Bin, ProgramData and All Users; skips files such as autorun.inf, index.html, boot.ini, bootmgr, desktop.ini, iconcache.db, ntldr, ntuser.dat, thumbs.db; and skips the extensions .atomsilo, .hta, .html, .exe, .dll, .cpl, .ini, .cab, .cur, .drv, .hlp, .icl, .icns, .ico, .idx, .sys, .spl and .ocx. Ransom notes are written as index.html in directories that contain .php/.asp/.jsp/.html files and as README-FILE-[Computer Name]-[Timestamp].hta elsewhere. The note embeds the encrypted key in <asf>, <csf> and <bsf> tags, demands USD 1,000,000 (reduced by half within 48 hours), gives the contact arvato@atomsilo.com plus a Tor site, and sets a 5-day deadline. The analyzed sample itself shows no shadow-copy deletion or service termination, although SentinelOne reports process/service termination and self-deletion in other builds.

Sophos MTR Rapid Response investigated an intrusion in which the operators exploited Atlassian Confluence CVE-2021-26084 (OGNL injection) on 2021-09-13, dropped a backdoor, moved laterally to multiple servers within about five hours using compromised administrative credentials and WMI execution resembling SecureAuthCorp's wmiexec, and ran discovery via logs.bat. A signed, DLL-hijack-vulnerable McAfee VirusScan Enterprise component (mfeann.exe) was used to side-load a malicious DLL decrypted from mfc.ini, yielding a Cobalt Strike-like backdoor. On 2021-09-24 the actors used RDP, ran Rclone to copy data to a Dropbox account, used a Kernel Driver Utility hacktool (autologin.exe, autologin.sys, drv64.dll) to disable Sophos file-scanning services, and deployed the ransomware (autoupdate.exe) across domain controllers using batch files, a service named 'Update', scheduled-task XML and Group Policy. Sophos assessed the ransomware as virtually identical to LockFile, with ransom 'rules' resembling DarkSide/BlackMatter; the operators are either new or a rebrand. No named actor, nation-state or CVE-specific attribution is stated in any source. SentinelOne also reports spearphishing attachments as an alternate delivery route.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Phishing: Spearphishing Attachment
- T1078 Valid Accounts
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1047 Windows Management Instrumentation
- T1543.003 Create or Modify System Process: Windows Service
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1622 Debugger Evasion
- T1070.004 Indicator Removal: File Deletion
- T1057 Process Discovery
- T1082 System Information Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AtomSilo Post-Exploitation — mfeann.exe DLL Side-Loading with mfc.ini Payload** (`TL-2026-5288-SPL-002`)

Detects execution of the signed McAfee component mfeann.exe outside McAfee directories (or from user-writable paths even when the folder name imitates McAfee), unsigned DLLs loaded by it, and creation of mfc.ini. Sophos observed AtomSilo operators side-loading a malicious DLL via mfeann.exe that decrypted the encrypted mfc.ini payload into a Cobalt Strike-like backdoor (T1574.001/T1574.002 side-loading, T1036.005 trusted-name masquerade, T1140 payload decoding).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1574.002, T1036.005, T1140
- **Data sources:** sysmon, microsoft_defender_for_endpoint:DeviceProcessEvents, microsoft_defender_for_endpoint:DeviceImageLoadEvents, process_creation, file_event
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 Image="*mfeann.exe") OR (EventCode=7 Image="*mfeann.exe" Signed=false) OR (EventCode=11 TargetFilename="*mfc.ini"))
| eval signal=case(EventCode=1,"mfeann_exec",EventCode=7,"unsigned_dll_loaded_by_mfeann",EventCode=11,"mfc_ini_written"), in_mcafee_path=if(like(Image,"%McAfee%"),1,0), user_writable=if(match(lower(Image),"users|temp|programdata|public"),1,0)
| where in_mcafee_path=0 OR user_writable=1
| stats count values(signal) as signals values(ImageLoaded) as dlls_loaded values(TargetFilename) as files values(CommandLine) as command_lines min(_time) as first_seen by host, User, Image
| eval first_seen=strftime(first_seen,"%F %T")
```

### Microsoft KQL

```kql
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "mfeann.exe"
 | where FolderPath !has "McAfee" or FolderPath has_any ("\\Users\\", "\\Temp\\", "\\ProgramData\\", "\\Public\\")
 | project Timestamp, DeviceName, Account = AccountName, Signal = "mfeann_exec", Path = FolderPath, Detail = ProcessCommandLine),
(DeviceImageLoadEvents
 | where Timestamp > ago(24h)
 | where InitiatingProcessFileName =~ "mfeann.exe"
 | where InitiatingProcessFolderPath !has "McAfee" or FolderPath !has "McAfee"
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "mfeann_dll_load", Path = FolderPath, Detail = FileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "mfc.ini" and ActionType == "FileCreated"
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "mfc_ini_drop", Path = FolderPath, Detail = InitiatingProcessFileName)
| order by Timestamp desc
```

### Sigma

```yaml
title: McAfee mfeann.exe Executed Outside McAfee Directory - DLL Side-Loading
id: 0c7d9a52-3e18-4b6f-a1d4-52f8c9e07b13
status: experimental
description: Detects mfeann.exe running from a path that is not a McAfee install directory, or from a user-writable path. AtomSilo operators abused this signed binary to side-load a malicious DLL that decrypted the mfc.ini backdoor payload (TL-2026-5288).
references:
  - https://www.sophos.com/en-us/blog/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.t1574.002
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mfeann.exe'
  filter_mcafee:
    Image|contains: 'McAfee'
  selection_writable:
    Image|contains:
      - '\Users\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Public\'
  condition: selection and (not filter_mcafee or selection_writable)
falsepositives:
  - Portable or relocated McAfee VirusScan Enterprise installations
level: high
---
title: AtomSilo Encrypted Backdoor Payload mfc.ini Created
id: b4d6f8a0-2c3e-4d5a-9f71-8a0c2e4b6d93
status: experimental
description: Detects creation of mfc.ini, the encrypted payload that the DLL side-loaded by mfeann.exe decrypts into a Cobalt Strike-like backdoor in the AtomSilo intrusion (TL-2026-5288).
references:
  - https://www.sophos.com/en-us/blog/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.defense_evasion
  - attack.t1140
  - attack.t1574.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\mfc.ini'
  filter_mcafee:
    Image|contains: 'McAfee'
  condition: selection and not filter_mcafee
falsepositives:
  - Unrelated applications that legitimately use an mfc.ini configuration file
level: medium
```

**Known false positives:**

- Relocated or portable McAfee VirusScan Enterprise deployments running mfeann.exe from a non-standard path
- Software packaging or lab environments that stage McAfee binaries in temporary directories
- Unrelated applications that use a configuration file named mfc.ini

**Tuning notes:** The user-writable-path branch catches attackers who stage the binary in a folder containing the word McAfee. Allowlist your managed McAfee install paths and hash the legitimate mfeann.exe (SHA256 07bbd8a80b5377723b13dbb40a01ca44cbc203369f5e5652a25b448e27ca108c was reported by Sophos) for exact matching. Sysmon event 7 (image load) with Signed=false needs the ImageLoad rule enabled for the mfeann.exe process. Correlate hits with a preceding Confluence exploitation alert (SPL-001) on the same host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AtomSilo Lateral Execution — wmiexec-Style WMI Commands and [indicator]/[indicator] Discovery (locked: unlock with TL Creds)
- AtomSilo Defense Evasion — Kernel Driver Utility ([indicator] / [indicator]) Used to Disable Endpoint Protection (locked: unlock with TL Creds)
- AtomSilo Exfiltration — Rclone Data Copy to Dropbox (locked: unlock with TL Creds)
- AtomSilo Ransomware Encryption Artifacts — [indicator] Files and README-FILE HTA Ransom Notes (locked: unlock with TL Creds)
- AtomSilo Domain-Wide Deployment — 'Update' Service, Scheduled Task and GPO Scheduled-Task Push (locked: unlock with TL Creds)
- AtomSilo Lateral Movement — RDP Logons with Compromised Administrative Credentials (locked: unlock with TL Creds)
- AtomSilo Initial Access — Confluence CVE-2021-26084 OGNL Injection and Confluence-Spawned Shell (locked: unlock with TL Creds)
- AtomSilo C2 and Ransomware Contact Infrastructure Connections (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `139.180.184[.]147`
- Domain: `update[.]ajaxrenew[.]com`
- File hash: `7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AtomSilo Ransomware Analysis - Chuong Dong](https://www.chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/)
- [Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack - Sophos](https://www.sophos.com/en-us/blog/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack)
- [Atom Silo Uses DLL Side-Loading to Deploy Ransomware - Infosecurity Magazine](https://www.infosecurity-magazine.com/news/atom-silo-dll-ransomware/)
- [Malware Research on AtomSilo Ransomware - CYFIRMA](https://www.cyfirma.com/research/malware-research-on-atomsilo-ransomware/)
- [AtomSilo Ransomware: In-Depth Analysis, Detection, Mitigation, and Removal - SentinelOne](https://www.sentinelone.com/anthology/atomsilo/)
- [New Atom Silo Ransomware Group Targets Confluence Servers - Dark Reading](https://www.darkreading.com/threat-intelligence/new-atom-silo-ransomware-group-targets-confluence-servers)
- [Detecting Atom Silo Ransomware Infections - SOC Prime](https://socprime.com/blog/detecting-atom-silo-ransomware-infections/)
- [AtomSilo ransomware arrives through a Confluence server hole - Anti-Malware.ru](https://www.anti-malware.ru/news/2021-10-05-114534/37119)
- [Atom Silo exploits a recent Confluence vulnerability to deploy ransomware - Cybersecurity-Help](https://www.cybersecurity-help.cz/blog/2344.html)
- [NVD - CVE-2021-26084](https://nvd.nist.gov/vuln/detail/CVE-2021-26084)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5288