Critical Atlassian Flaw Exploited to Deploy Linux Variant of Cerber Ransomware

Danger actors are exploiting unpatched Atlassian servers to deploy a Linux variant of Cerber (aka C3RB3R) ransomware.

The attacks leverage CVE-2023-22518 (CVSS rating: 9.1), a critical security vulnerability impacting the Atlassian Confluence Facts Center and Server that will allow an unauthenticated attacker to reset Confluence and produce an administrator account.

Armed with this access, a danger actor could consider above afflicted units, main to a total decline of confidentiality, integrity, and availability.

According to cloud security agency Cado, financially determined cybercrime teams have been observed abusing the newly designed admin account to install the Effluence web shell plugin and enable for the execution of arbitrary commands on the host.

“The attacker works by using this web shell to download and run the key Cerber payload,” Nate Bill, risk intelligence engineer at Cado, claimed in a report shared with The Hacker Information.

“In a default put in, the Confluence application is executed as the ‘confluence’ person, a very low privilege person. As this sort of, the facts the ransomware is ready to encrypt is limited to files owned by the confluence person.”

It truly is really worth noting that the exploitation of CVE-2023-22518 to deploy Cerber ransomware was previously highlighted by Swift7 in November 2023.

Published in C++, the principal payload functions as a loader for additional C++-centered malware by retrieving them from a command-and-management (C2) server and then erasing its personal presence from the contaminated host.

It consists of “agttydck.bat,” which is executed to download the encryptor (“agttydcb.bat”) that’s subsequently released by the major payload.

It truly is suspected that agttydck functions akin to a permission checker for the malware, evaluating its capability to publish to a /tmp/ck.log file. The precise reason of this check out is unclear.

The encryptor, on the other hand, traverses the root listing and encrypts all contents with a .L0CK3D extension. It also drops a ransom be aware in just about every directory. Even so, no information exfiltration takes place irrespective of claims to the contrary in the observe.

The most attention-grabbing facet of the attacks is the use of pure C++ payloads, which are turning out to be a thing of a rarity presented the change to cross-system programming languages like Golang and Rust.

“Cerber is a rather complex, albeit getting old, ransomware payload,” Invoice stated. “While the use of the Confluence vulnerability lets it to compromise a significant amount of very likely higher worth techniques, usually the data it is capable to encrypt will be restricted to just the confluence information and in nicely configured methods this will be backed up.”

“This greatly limitations the efficacy of the ransomware in extracting revenue from victims, as there is a lot considerably less incentive to pay up,” the researcher included.

The advancement arrives amid the emergence of new ransomware family members like Evil Ant, HelloFire, L00KUPRU (an Xorist ransomware variant), Muliaka (primarily based on the leaked Conti ransomware code), Napoli (a Chaos ransomware variant), Pink CryptoApp, Risen, and SEXi (based on the leaked Babuk ransomware code) that have been spotted targeting Windows and VMware ESXi servers.

Ransomware actors are also leveraging the leaked LockBit ransomware source code to spawn their very own custom variants like Lambda (aka Synapse), Mordor, and Zgut, in accordance to reviews from F.A.C.C.T. and Kaspersky.

The latter’s investigation of the leaked LockBit 3. builder documents has unveiled the “alarming simplicity” with which attackers can craft bespoke ransomware and increase their capabilities with additional powerful options.

Kaspersky explained it uncovered a tailored variation with the ability to spread across the network through PsExec by having advantage of stolen administrator qualifications and performing destructive routines, these kinds of as terminating Microsoft Defender Antivirus and erasing Windows Occasion Logs in purchase to encrypt the data and protect its tracks.

“This underscores the require for strong security actions able of mitigating this sort of menace correctly, as properly as adoption of a cybersecurity culture among the employees,” the company explained.

Identified this post attention-grabbing? Follow us on Twitter  and LinkedIn to read much more unique written content we post.

Some pieces of this posting are sourced from:
thehackernews.com