Analyzing a Cerber Ransomware Attack via Confluence RCE Exploit (CVE-2023-22518) | Threat SnapShot

Confluence has been hit hard lately -- attackers are actively exploiting another vulnerability in Confluence Server that allows complete takeover from an unauthenticated account. In the case of CVE-2023-22518, a single POST request is made to the /json/setup-restore.action endpoint with a specified header of “X-Atlassian-Token”: “no-check”. This endpoint allows a Confluence administrator to restore the Confluence site from a specified backup zip directory. An attacker could easily upload a valid, harmful backup zip directory and proceed to restore the Confluence server to a state with known malicious content. Once administrative privileges are acquired through the introduction of an injected admin user, malicious actors have the freedom to deploy an Atlassian Web Shell plugin for remote code execution, extract confidential data from Confluence spaces, or install ransomware.
In this Threat SnapShot, we'll take a look at how the Cerber ransomware operators are leveraging this Confluence vulnerability to infect victims. After successfully gaining access via the vulnerability, they use an encoded PowerShell command to download and execute a remote payload, which will then encrypt the files in the system and append the extension “.L0CK3D”. It will also drop a ransom note with the filename “read-me3.txt” in all directories where something was encrypted. We'll take a closer look at this infection chain, and discuss threat hunting and detection strategies.
Resources:
- www.trendmicro...
- github.com/For...
- app.snapattack... - Collection: CVE-2023-22518
- app.snapattack... - Threat: Cerber Ransomware via Confluence CVE-2023-22518
- app.snapattack... - Detection: Confluence Restore Exploitation
- app.snapattack... - Detection: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
- app.snapattack... - Detection: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)
- app.snapattack... - Detection: Cerber Powershell Stager
- app.snapattack... - Detection: Webshell-Indicative Process Tree
- app.snapattack... - Attack Script: CVE-2023-22518 Confluence Improper Authorization Traffic