Multiple threat actors compromised self‑hosted JFrog Artifactory build servers over a 24‑day window, installing persistent Rust backdoors after chaining two patched authentication vulnerabilities.

Security researchers have uncovered a coordinated 24‑day intrusion campaign that targeted self‑hosted JFrog Artifactory servers, installing stealthy Rust‑based backdoors that persisted even after the vendors released patches for the exploited authentication flaws.

Attack Overview

The campaign began with threat actors exploiting two separate authentication vulnerabilities that had been patched by JFrog earlier in the year. By chaining these flaws, the attackers gained administrative access to the Artifactory instances and uploaded malicious Rust binaries that acted as persistent backdoors.

Unlike typical post‑exploitation tools that are removed during routine updates, the Rust backdoors were compiled into custom plugins that blended with legitimate Artifactory extensions, allowing them to survive standard patching procedures.

Exploitation Chain

  • Vulnerability A: An unauthenticated API endpoint allowed enumeration of repository metadata.
  • Vulnerability B: A privilege‑escalation bug in the token validation logic permitted forged admin tokens.
  • Chaining the two enabled attackers to upload arbitrary files to the server’s plugin directory.

Once the malicious plugin was in place, it established a covert command‑and‑control channel over HTTPS, evading many network‑based detection tools.

Persistence Mechanisms

The Rust backdoors leveraged the Artifactory plugin architecture, which automatically loads binaries from the plugins folder at startup. Because the binaries were signed with a valid developer key, the platform’s integrity checks did not flag them as malicious.

Even after administrators applied the official patches for the authentication bugs, the backdoors remained functional, highlighting the need for deeper file‑integrity monitoring and regular audits of custom plugins.

Mitigation Recommendations

Organizations running self‑hosted Artifactory should immediately audit all installed plugins, verify signatures, and remove any that are not part of the official JFrog distribution.

Additional steps include rotating all access tokens, enforcing multi‑factor authentication for admin accounts, and implementing file‑system integrity tools that can detect unauthorized binary changes.

TechTimes coverage of JFrog Artifactory hack