Attackers Exploit Critical Confluence Authorization Flaw to Deploy Cerber Ransomware

Attackers exploited CVE-2023-22518 in internet-facing Atlassian Confluence Data Center and Server instances to deploy Cerber ransomware during a November 2023 campaign. The improper authorization flaw lets unauthenticated attackers reset Confluence, create an administrator account, and take administrative control; abuse of backup restoration also enabled web-shell deployment. Atlassian confirmed active exploitation and raised the vulnerability’s CVSS score from 9.1 to 10.0. Rapid7 and Red Canary observed attacks on November 5, while 360 researchers reported exploitation as early as November 1 and attacks affecting both Windows and Linux servers. Atlassian Cloud was unaffected.

Observed attack chains used setup-restore endpoints, reconnaissance, web shells, and encoded PowerShell to download ransomware, including from 193.176.179[.]41. Analyzed Windows payloads could encrypt local and network-share files, delete volume shadow copies, drop ransom notes, and remove themselves. Rapid7’s successful ransomware cases affected the compromised Confluence server, without demonstrating broader network propagation; it also observed attempts targeting the separate CVE-2023-22515 vulnerability. Organizations should immediately install Atlassian’s fixed releases. Where patching is delayed, Atlassian recommends restricting internet access and blocking the three affected setup-restore endpoints as temporary mitigations. Defenders should investigate suspicious Tomcat child processes, encoded PowerShell execution, and unexpected payload downloads.