Hackers Exploited Atlassian Confluence Bug to Deploy Ljl Backdoor for Espionage

A threat actor is said to have “highly likely” exploited a
security flaw in an outdated Atlassian Confluence server to deploy
a never-before-seen backdoor against an unnamed organization in the
research and technical services sector.

The attack, which transpired over a seven-day-period during the
end of May, has been attributed to a threat activity cluster
tracked by cybersecurity firm Deepwatch as
TAC-040.

“The evidence indicates that the threat actor executed malicious
commands with a parent process of tomcat9.exe in Atlassian’s
Confluence directory,” the company said^[1]. “After the initial
compromise, the threat actor ran various commands to enumerate the
local system, network, and Active Directory environment.”

The Atlassian vulnerability suspected to have been exploited is
CVE-2022-26134^[2], an Object-Graph
Navigation Language (OGNL) injection flaw that paves the way for
arbitrary code execution on a Confluence Server or Data Center
instance.

Following reports of active exploitation in real-world attacks,
the issue was addressed by the Australian company on June 4,
2022.

But given the absence of forensic artifacts, Deepwatch theorized
the breach could have alternatively entailed the exploitation of
the Spring4Shell vulnerability (CVE-2022-22965^[3]) to gain initial access
to the Confluence web application.

Not much is known about TAC-040 other than the fact that the
adversarial collective’s goals could be espionage-related, although
the possibility that the group could have acted out of financial
gain hasn’t been ruled out, citing the presence of a loader for an
XMRig crypto miner on the system.

While there is no evidence that the miner was executed in this
incident, the Monero address owned by the threat actors has netted
at least 652 XMR ($106,000) by hijacking the computing resources of
other systems to illicitly mine cryptocurrency.

The attack chain is also notable for the deployment of a
previously undocumented implant called Ljl Backdoor on the
compromised server. Roughly 700MB of archived data is estimated to
have been exfiltrated before the server was taken offline by the
victim, according to an analysis of the network logs.

The malware, for its part, is a fully-featured trojan virus
designed to gather files and user accounts, load arbitrary .NET
payloads, and amass system information as well as the victim’s
geographic location.

“The victim denied the threat actor the ability to laterally
move within the environment by taking the server offline,
potentially preventing the exfiltration of additional sensitive
data and restricting the threat actor(s) ability to conduct further
malicious activities.”