{"id":19332,"date":"2022-06-14T05:10:20","date_gmt":"2022-06-14T13:10:20","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/06\/14\/news-13065\/"},"modified":"2022-06-14T05:10:20","modified_gmt":"2022-06-14T13:10:20","slug":"news-13065","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/06\/14\/news-13065\/","title":{"rendered":"&#8220;Multiple adversaries&#8221; exploiting Confluence vulnerability, warns Microsoft"},"content":{"rendered":"<p><strong>Credit to Author: Christopher Boyd| Date: Tue, 14 Jun 2022 12:43:08 +0000<\/strong><\/p>\n<p>Microsoft has warned that &#8220;multiple adversaries and nation-state actors&#8221; are making use of the recent Atlassian Confluence RCE vulnerability. A fix is now available for <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26134\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2022-26134<\/a>. It is essential users of Confluence address the patching issue immediately. <\/p>\n<h2>Confluence vulnerability: Background<\/h2>\n<p>At the start of June, researchers <a href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/06\/unpatched-atlassian-confluence-vulnerability-is-actively-exploited\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">discovered a vulnerability<\/a> in Atlassian Confluence via an incident response investigation. Confluence, a Wiki-style collaboration tool, experienced a &#8220;critical unauthenticated remote code execution vulnerability&#8221;. It affected Confluence server and Confluence Data Center.<\/p>\n<p>The attack discovered during the investigation revealed web shells deployed on the server. These web shells allow for Persistent access on compromised web applications. The web server process and its child processes ran as root and full privileges. This is very bad news, and allowed for execution of commands even without valid credentials.<\/p>\n<p>Worse, the web shell found is one commonly used by various Advanced Persistent Threat (APT) groups. This almost certainly isn&#8217;t the kind of thing admins discovering an attack want to hear mid-investigation.<\/p>\n<p>Unfortunately, mitigation advice was somewhat limited. It veered between restricting access to just turning off Confluence Server and Data Center instances. On June 3, Atlassian <a href=\"https:\/\/confluence.atlassian.com\/doc\/confluence-release-notes-327.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">released<\/a> versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1 which contained a fix for this vulnerability.<\/p>\n<h2>The current situation<\/h2>\n<p>Here&#8217;s the latest observations from Microsoft:<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Multiple adversaries and nation-state actors, including DEV-0401 and DEV-0234, are taking advantage of the Atlassian Confluence RCE vulnerability CVE-2022-26134. We urge customers to upgrade to the latest version or apply recommended mitigations: <a href=\"https:\/\/t.co\/C3CykQgrOJ\">https:\/\/t.co\/C3CykQgrOJ<\/a><\/p>\n<p>&mdash; Microsoft Security Intelligence (@MsftSecIntel) <a href=\"https:\/\/twitter.com\/MsftSecIntel\/status\/1535417776290111489?ref_src=twsrc%5Etfw\">June 11, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/div>\n<\/figure>\n<p>Microsoft continues:<\/p>\n<blockquote class=\"wp-block-quote\">\n<p><em>In many cases impacted devices have been observed with multiple disparate instances of malicious activity, including extensive device and domain discovery, and the deployment of payloads like Cobalt Strike, web shells, botnets like Mirai and Kinsing, coin miners, and ransomware.<\/em><\/p>\n<\/blockquote>\n<h2>A mixed bag of attacks<\/h2>\n<p>Industrious malware authors really have been having a grand time of things with this vulnerability. As noted by Microsoft, several varied approaches to compromise and exploitation are being used. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/confluence-servers-hacked-to-deploy-avoslocker-cerber2021-ransomware\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">AvosLocker Ransomware<\/a> and <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/linux-botnets-now-exploit-critical-atlassian-confluence-bug\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Linux botnets<\/a> are getting in on the action. Cryptomining <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-exploit-recently-patched-confluence-bug-for-cryptomining\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">jumping on the bandwagon<\/a> is an inevitability across most scams we see, and this is no exception.<\/p>\n<p>Microsoft also noticed the Confluence vulnerability being exploited to download and deploy Cerber2021 ransomware. The Record <a href=\"https:\/\/therecord.media\/microsoft-ransomware-groups-nation-states-exploiting-atlassian-confluence-vulnerability\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">observed<\/a> that Cerber2021 is a &#8220;relatively minor player&#8221;, with both Windows and Linux versions used to lock up machines. Here&#8217;s an example of the ransomware, via MalwareHunterTeam:<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">There is a ransomware currently active that is calling itself Cerber.<br \/>Has Windows &amp; Linux versions.<br \/>Looks started to spread in the first half of November. IDR seen both Linux (multiple victims got git files encrypted) &amp; Windows user victims already from different countries.<br \/><img decoding=\"async\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/1f440.png\" alt=\"\ud83d\udc40\" class=\"wp-smiley\" style=\"height: 1em; max-height: 1em;\" \/><br \/><img decoding=\"async\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/1f914.png\" alt=\"\ud83e\udd14\" class=\"wp-smiley\" style=\"height: 1em; max-height: 1em;\" \/> <a href=\"https:\/\/t.co\/saPGsTlDbt\">pic.twitter.com\/saPGsTlDbt<\/a><\/p>\n<p>&mdash; MalwareHunterTeam (@malwrhunterteam) <a href=\"https:\/\/twitter.com\/malwrhunterteam\/status\/1467264298237972484?ref_src=twsrc%5Etfw\">December 4, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/div>\n<\/figure>\n<p>Having the fixes to address this issue is great, but organisations need to actually make use of them. This is still a serious problem for anyone using unpatched versions of affected Confluence installations.<\/p>\n<p>If you don&#8217;t want to run the gauntlet of APT groups, cryptomining chancers, botnets and more, the message is loud and clear: get on over to the <a href=\"https:\/\/www.atlassian.com\/software\/confluence\/download-archives\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Confluence Download Archives<\/a> and patch immediately.<\/p>\n<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/06\/multiple-adversaries-exploiting-confluence-vulnerability-warns-microsoft\/\">&#8220;Multiple adversaries&#8221; exploiting Confluence vulnerability, warns Microsoft<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/06\/multiple-adversaries-exploiting-confluence-vulnerability-warns-microsoft\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Christopher Boyd| Date: Tue, 14 Jun 2022 12:43:08 +0000<\/strong><\/p>\n<p>Microsoft has warned of APT groups and ransomware authors exploiting the now patched Confluence vulnerability. We take a look at the dangers.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/06\/multiple-adversaries-exploiting-confluence-vulnerability-warns-microsoft\/\">&#8220;Multiple adversaries&#8221; exploiting Confluence vulnerability, warns Microsoft<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[11029,26411,21782,22783,18191,3765],"class_list":["post-19332","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-apt","tag-atlassian","tag-confluence","tag-exploits-and-vulnerabilities","tag-nation-state","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=19332"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19332\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=19332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=19332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=19332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}