[News](/news) Terrorist hackers target Atlassian & Oracle servers [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Terrorist hackers target Atlassian & Oracle servers ##### [Edward Kost](/team/edward-kost) February 7, 2021 Volatile Cedar, a cybercriminal group affiliated with the Hezbollah Cyber Unit, has resurfaced after disappearing for almost 6 years. The criminal group was suddenly illuminated on the radar after suspicious activity on Oracle and Atlassian servers was discovered. Volatile cedar breached unpatched Atlassian and Oracle servers by exploiting the following vulnerabilities - [CVE-2012-3152](https://nvd.nist.gov/vuln/detail/CVE-2012-3152), [CVE-2019-11581](https://www.upguard.com/blog/jira-security-vulnerability-cve-2019-11581), and [CVE-2019-3396](https://nvd.nist.gov/vuln/detail/CVE-2019-3396).  These attacks were reconnaissance campaigns to learn the strategies and behaviors of specific enemies.  The net was wide, covering the United States, Egypt, Jordan, the United Kingdom, Saudi Arabia, Europe, the UAE, and even the Palestinian Authority. The targets were telecommunication companies and the intelligence breached included client call records amongst other private data. Volatile Cedar’s operations were strategically ordered to amplify the geographical range between them and evade detection. Other evasion tactics included shifting the attack surface from computer to public servers and using [common web shell utilities](https://www.upguard.com/blog/what-are-web-shell-attacks) rather than other detectable tools. These clever concealment practices suggest that the group may have remained active during the last 6 years leaving behind only heavily obfuscated trails. But the group has finally left a calling card -  a remote access tool exclusive to Volatile Cedar known as “Explosive RAT. “Explosive RAT” is an updated version of the trojan “Explosive”, also developed by the criminal group. This trojan is usually deployed via a compromised open-source JSP file browser.  The Explosive RAT trojan has been specifically designed for [sensitive data](https://www.upguard.com/blog/sensitive-data) theft and [corporate espionage](https://www.upguard.com/blog/corporate-espionage). It has also been engineered to reflect Volatile’s characteristic evasion tactics. One such example is memory usage monitoring to avoid suspicious processing allocations. Volatile Cedar’s crimes uncovers a concerning progression in Hezbollah’s hacking capabilities - not only have their methods evolved, they’re now also developing their own tools. ## How secure is Oracle? Oracle develops and markets database software, cloud infrastructure services, and enterprise software applications. The company provides integrated systems combining hardware and software for business operations, data management, and application development. Oracle serves businesses and organizations across multiple industries globally. * View our free preliminary report on Oracle’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Oracle's score](/security-report/oracle) [View score](/security-report/oracle) [https://www.oracle.com](/security-report/oracle) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)