Linux Cerber Ransomware Variant Exploits Atlassian Servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an improper authorization flaw (CWE-863) that can be triggered by an unauthenticated attacker sending crafted requests to a vulnerable instance. Successful exploitation gives the attacker control over the instance and can cause significant data loss, such as wiping or resetting the Confluence site, but there is no confidentiality impact because no data can be exfiltrated. Any organization running a self-managed Confluence Data Center or Server deployment is in scope. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-07 with ransomware use noted, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is known, but ransomware operators are already using the flaw in the wild. Do: Upgrade every Confluence Data Center and Server instance to the patched release for your branch listed in Atlassian's advisory, per the CISA KEV required action (apply vendor mitigations or discontinue use). In the interim, restrict internet access to Confluence and check for signs of compromise such as unexpected instance resets, missing data, or ransom notes; restore from backups if data loss is detected. | 9.8 | 100% | KEV ransomware PoC |
| large≈70,000+ internet-exposed Confluence instances per public scans, likely 100k+ total self-managed installations |
Full article329 words · extracted from infosecurity-magazine.com · click to collapse
Threat actors have been observed exploiting unpatched Atlassian servers and deploying a Linux variant of Cerber ransomware, also known as C3RB3R.
The attacks capitalize on CVE-2023-22518, a critical security vulnerability in Atlassian Confluence Data Center and Server, enabling an unauthenticated attacker to reset Confluence and create an administrator account.
Armed with this access, threat actors gain control over systems, risking loss of confidentiality, integrity and availability. Financially motivated cybercrime groups leverage the newly created admin account to install the Effluence web shell plugin, facilitating arbitrary command execution.
Nate Bill, a threat intelligence engineer at Cado, discussed the findings in a blog post published on Tuesday. He noted that the primary Cerber payload is executed under the ‘confluence’ user, limiting its encryption scope to files owned by that user. This exploitation was previously flagged by Rapid7 in November 2023.
The core component of the ransomware, programmed in C++, acts as a carrier for more harmful software, also written in C++. This additional software is fetched from a central server controlled by the attackers.
Once its task is complete, the main ransomware component removes itself from the system. Two other components are involved: one checks if the ransomware has the necessary permissions, while the other encrypts files on the computer, rendering them inaccessible until a ransom is paid.
Despite claims in the ransom note, no data exfiltration occurs. According to Bill, the predominance of pure C++ payloads is noteworthy amid the shift to cross-platform languages like Golang and Rust.
The security researcher emphasized Cerber’s sophistication but noted limitations in encrypting only Confluence data, especially in well-configured systems with backups, reducing the incentive for victims to pay.
These developments coincide with the emergence of new ransomware families targeting Windows and VMware ESXi servers. Additionally, ransomware actors are customizing variants using leaked LockBit ransomware source code, highlighting the need for robust security measures and a strong cybersecurity culture among employees.
Read more about these threats: New LockBit Variant Exploits Self-Spreading Features
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/linux-cerber-ransomware-exploits/