Critical Confluence RCE Exploited to Deploy Cryptominers, Sliver Implants and Godzilla Backdoors

Attackers exploited CVE-2023-22527, a CVSS 10.0 template-injection vulnerability in Atlassian Confluence Data Center and Server, to execute code without authentication and deploy cryptominers and backdoors. Atlassian issued an advisory and patches on January 16, 2024; SANS subsequently observed increased exploitation attempts, and FortiGuard confirmed active attempts and IPS coverage. Public exploit code targeted /template/aui/text-inline.vm through OGNL injection. In an investigation involving two internet-facing Confluence servers, Rapid7 found exploitation followed by XMRigCC cryptomining with root-level service persistence and Sliver implants communicating with 193.29.13.179:8888 over mutual TLS. Post-exploitation activity included reconnaissance, credential-access activity, and deployment of Kerbrute, Traitor and Fscan for account enumeration, privilege escalation and network discovery. Rapid7 contained the incident and identified no additional objectives.

Trend Micro separately documented exploitation of the same flaw to install Godzilla in-memory webshells. Attackers used OGNL and JavaScript to load Java code into memory and inject a malicious valve into Tomcat’s request-processing pipeline. AES-encrypted communications and dynamically loaded payloads reduced exposure to disk-based detection. Researchers demonstrated command execution but did not capture subsequent attacker payloads; potential botnet use remained speculative. Organizations should upgrade affected Confluence deployments to supported, patched versions and treat unpatched, exposed systems as potentially compromised. Response should include checking for unauthorized services, cryptominers, Sliver activity and in-memory backdoors, while restricting unnecessary exposure and shell capabilities and centralizing firewall logs to identify abnormal outbound communications.