HellCat Jira Authentication from Anomalous Source After Credential Inactivity

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects successful authentication to Atlassian Jira from an anomalous network source (e.g., proxied or unusual geolocation/ASN) following a period of credential inactivity. This activity is consistent with tactics used by the HellCat ransomware group, who leverage credentials harvested by infostealers (such as Raccoon, Redline, StealC, or Lumma) to gain initial unauthorized access to corporate Jira environments.