Sharing this here for awareness, and it's related to something @bdw429s was talking about last week on this thread https://cfml.slack.com/archives/C06TABBT8/p1710273509832619?thread_ts=1710270949.513319&cid=C06TABBT8 - an example of deploying a malicious Lucee extension after a Lucee Admin compromise. Standard recommendations apply here: keep Lucee patched / ensure strict access control for Lucee admin (or disable the admin server altogether) / change default passwords (it looks like the

connections

default password mentioned here may be from a commercial offering build on Lucee) https://www.sprocketsecurity.com/resources/building-lucee-extensions-for-remote-code-execution