Hackers Exploit Atlassian Confluence Vulnerability to Deploy New ‘Ljl’ Backdoor

Cybersecurity professionals from Deepwatch noticed action from danger actors (TA) that “hugely probably” exploited a security flaw in the Atlassian Confluence server (CVE-2022-26134) to deploy a new backdoor dubbed “Ljl” towards a selection of unnamed companies.

Deepwatch’s Adversary Methods and Intelligence team (ATI) explained the results in an advisory released on Tuesday.

Soon after gaining initial entry, the TA, dubbed TAC-040, would have operate different commands to enumerate the nearby procedure, network and Active Listing atmosphere. 

Additionally, Deepwatch explained the TA possible employed RAR and 7zip to archive information and folders from various directories, such as registry hives. 

According to network logs, TAC-040 exfiltrated a whole of all-around 700 MBs of archived details right before the target took the server offline.

Ahead of disconnecting, nonetheless, the TA would have dropped a by no means-right before-viewed backdoor, known as “Ljl Backdoor” onto the compromised server.

“TAC-040 has the ability to make or entry customized, never ever-just before-found malware,” the advisory reads.

In phrases of the motifs powering the attacks, Deepwatch reported they were very likely espionage-similar, but the business can not entirely rule out that they were being financially motivated, since it reported it also spotted a loader for an XMRig crypto miner on the process.

Targets of TAC-040 were companies that conduct study in healthcare, instruction, intercontinental enhancement, and environmental and agriculture, as properly as some that provide technical products and services.

For context, the Atlassian vulnerability suspected to have been exploited by TAC-040 is an Object-Graph Navigation Language (OGNL) injection bug that will allow for arbitrary code execution on a Confluence Server or Knowledge Middle occasion.

The issue was tackled by Atlassian in June, but this is not the initial time considering that then that unpatched units get exploited by hackers.

For instance, in July Microsoft’s Security Intelligence staff reported it noticed a marketing campaign by TA 8220 concentrating on i686 and x86_64 Linux methods that employed RCE exploits for CVE-2022-26134 and CVE-2019-2725 (Oracle WebLogic) for first access.

Some components of this short article are sourced from:
www.infosecurity-magazine.com