Hackers Targeting Unpatched Atlassian Confluence Servers to Deploy Crypto Miners

A now-patched critical security flaw affecting Atlassian
Confluence Server that came to light a few months ago is being
actively exploited for illicit cryptocurrency mining on unpatched
installations.

“If left unremedied and successfully exploited, this
vulnerability could be used for multiple and more malicious
attacks, such as a complete domain takeover of the infrastructure
and the deployment information stealers, remote access trojans
(RATs), and ransomware,” Trend Micro threat researcher Sunil Bharti
said^[1]
in a report.

The issue, tracked as CVE-2022-26134^[2]
(CVSS score: 9.8), was addressed by the Australian software company
in June 2022.

In one of the infection chains observed by the cybersecurity
company, the flaw was leveraged to download and run a shell script
(“ro.sh”) on the victim’s machine, which, in turn, fetched a second
shell script (“ap.sh”).

The malicious code is designed to update the PATH variable^[3]
to include additional paths such as “/tmp”, download the cURL
utility (if not already present) from a remote server, disable
iptables firewall, abuse the PwnKit flaw^[4]
(CVE-2021-4034) to gain root privileges, and ultimately deploy the
hezb crypto miner.

Like other cryptojacking attacks, the shell script also
terminates other competing coin miners, disables cloud service
provider agents from Alibaba and Tencent, before carrying out
lateral movement via SSH.

The findings mirror similar exploitation attempts previously
disclosed by Lacework^[5], Microsoft, Sophos^[6], and Akamai^[7]
in June.

Lacework’s analysis further shows that the command-and-control
(C2) server used to retrieve the cURL software as well as the hezb
miner also distributed a Golang-based ELF binary named “kik^[8]” that enables the
malware to kill processes of interest.

Users are advised to prioritize patching the flaw as it could be
abused by threat actors for other nefarious purposes.

“Attackers could take advantage of injecting their own code for
interpretation and gain access to the Confluence domain being
targeted, as well as conduct attacks ranging from controlling the
server for subsequent malicious activities to damaging the
infrastructure itself,” Bharti said.