Confluence CVE-2019-3396 Exploited to Deploy Rootkit Miners and GandCrab Ransomware

Attackers exploited CVE-2019-3396, a vulnerability in Atlassian Confluence’s Widget Connector, to deliver Linux cryptocurrency-mining malware with a rootkit. Trend Micro documented a multistage shell-script infection chain that downloads Kerberods, establishes cron-based persistence, and deploys the khugepageds Monero miner alongside a locally compiled rootkit. A separate Alert Logic report identified active exploitation of the same Confluence vulnerability to deliver GandCrab ransomware, highlighting its use for multiple malicious payloads.

The mining campaign’s rootkit conceals processes, files, and network activity, falsifies reported CPU usage, and uses a hooked function to create a cron job that reinstalls the malware. Kerberods can also propagate through SSH and exploitation of CVE-2019-1003001 and CVE-2019-1003000. Trend Micro linked the campaign’s techniques to a November 2018 miner-rootkit attack, noting more extensive function hooking to evade detection. Defenders should apply vendor fixes to affected Confluence installations and investigate suspicious cron entries, SSH activity, and mining indicators; apparently normal CPU readings do not rule out compromise.