{"id":2175,"date":"2025-02-24T10:06:36","date_gmt":"2025-02-24T10:06:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/24\/hackers-exploited-confluence-server-vulnerability-to-deploy-lockbit-ransomware\/"},"modified":"2025-02-24T10:06:36","modified_gmt":"2025-02-24T10:06:36","slug":"hackers-exploited-confluence-server-vulnerability-to-deploy-lockbit-ransomware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/24\/hackers-exploited-confluence-server-vulnerability-to-deploy-lockbit-ransomware\/","title":{"rendered":"Hackers Exploited Confluence Server Vulnerability To Deploy LockBit Ransomware"},"content":{"rendered":"

Hackers Exploited Confluence Server Vulnerability To Deploy LockBit Ransomware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated ransomware attack leveraging a critical Atlassian Confluence vulnerability (CVE-2023-22527, CVSS 10.0) has been uncovered, culminating in the deployment of LockBit Black ransomware across enterprise networks within two hours of initial compromise.<\/p>\n

The attackers orchestrated a multi-stage intrusion involving credential theft, lateral movement via RDP, and automated ransomware distribution using legitimate tools like PDQ Deploy.<\/p>\n

\n
\"\"
Lateral movement via RDP (Source \u2013 The DFIR Report)<\/figcaption><\/figure>\n<\/div>\n

The breach began with the exploitation of CVE-2023-22527, a server-side template injection flaw allowing unauthenticated remote code execution<\/a> (RCE).<\/p>\n

\n
\"\"
RCE Exploit (Source \u2013 The DFIR Report)<\/figcaption><\/figure>\n<\/div>\n

Attackers injected malicious Object-Graph Navigation Language (OGNL) expressions via HTTP POST requests to \/template\/aui\/text-inline.vm<\/code>, enabling command execution as the NETWORK SERVICE<\/code> account.<\/p>\n

While the cybersecurity analysts at The DFIR Report noted<\/a> that the initial reconnaissance commands like net user<\/code> and whoami<\/code> were executed through a Python script, as evidenced by the python-requests\/2.25<\/code> user-agent in server logs.<\/p>\n

POST \/template\/aui\/text-inline.vm HTTP\/1.1  \nUser-Agent: python-requests\/2.25  \n...  \nContent: ...freemarker.template.utility.Execute().exec({\"whoami\"})  <\/code><\/pre>\n
After establishing a Meterpreter session via a malicious HTA file, the attackers pivoted to AnyDesk for persistent access.<\/p>\n
They disabled defenses by typing \u201cvirus\u201d into the Windows Start menu to deactivate Defender and cleared logs using PowerShell:-<\/p>\n
wevtutil el | ForEach-Object { wevtutil cl \"$_\" }  <\/code><\/pre>\n
Post-exfiltration, the hackers deleted tools like Mimikatz<\/a> and Rclone to erase traces:-<\/p>\n
C:tempmimikatzx64mimikatz.exe  \nC:temprclonerclone.exe  <\/code><\/pre>\n
\n
\"\"
Attacker disabling Windows Defender via GUI (Source \u2013 The DFIR Report)<\/figcaption><\/figure>\n<\/div>\n
Impact and Ransomware Deployment<\/strong><\/h2>\n
LockBit was deployed using PDQ Deploy, a legitimate IT tool, to execute a batch script (asd.bat<\/code>) across networked devices. The script triggered ransomware encryption, appending the .rhddiicoE<\/code> extension to files and modifying desktop wallpapers with LockBit\u2019s signature imagery.<\/p>\n
@echo off  \nstart cmd \/k \"C:tempLBB.exe -path \\TARGETC$\"  <\/code><\/pre>\n
\n
\"\"
LockBit\u2019s desktop wallpaper alteration post-encryption (Source \u2013 The DFIR Report)<\/figcaption><\/figure>\n<\/div>\n
Data exfiltration preceded encryption, with 1.5+ GB transferred to MEGA.io via Rclone. The threat actors\u2019 infrastructure, linked to Russian IPs and Flyservers S.A., reflects tactics previously associated with LockBit<\/a> affiliates.<\/p>\n
This incident depicts the critical need to patch Confluence servers and audit remote access tools.<\/p>\n
The attackers\u2019 rapid progression from initial access to ransomware deployment shows the importance of real-time endpoint monitoring<\/a> and credential hygiene.<\/p>\n
Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response and Threat Hunting \u2013\u00a0Register Here<\/a><\/code><\/strong><\/p>\n
The post Hackers Exploited Confluence Server Vulnerability To Deploy LockBit Ransomware<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Hackers Exploited Confluence Server Vulnerability To Deploy LockBit Ransomware A sophisticated ransomware attack leveraging a critical Atlassian Confluence vulnerability (CVE-2023-22527, CVSS 10.0) has been uncovered, culminating in the deployment of LockBit Black ransomware across enterprise networks within two hours of initial compromise. The attackers orchestrated a multi-stage intrusion involving credential theft, lateral movement via RDP, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,131],"tags":[130],"class_list":["post-2175","post","type-post","status-publish","format-standard","hentry","category-cyber-security-news","category-vulnerability","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2175"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=2175"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2175\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=2175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=2175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=2175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}