Analysis Summary

Threat actors have been exploiting an unpatched vulnerability in Atlassian servers to deploy a Linux variant of the Cerber ransomware. This critical security flaw, known as CVE-2023-22518, affects the Atlassian Confluence Data Center and Server enabling attackers to reset Confluence and create an administrator account without authentication. With this access, threat actors can assume control over affected systems, resulting in a complete compromise of confidentiality, integrity, and availability.

A cloud security firm has observed financially motivated cybercrime groups leveraging the newly created admin account to install the Effluence web shell plugin allowing for the execution of arbitrary commands on the host. This web shell is then used to download and execute the primary Cerber ransomware payload. While the ransomware encrypts data limited to files owned by the 'confluence' user, it's worth noting that no data exfiltration occurs despite claims made in the ransom note.

The report reads, "Cerber emerged and was at the peak of its activity around 2016, and has since only occasional campaigns, most recently targeting the aforementioned Confluence vulnerability."

The Cerber ransomware employs a sophisticated, albeit aging, payload written in C++, a rarity amidst the industry's shift towards cross-platform programming languages like Golang and Rust. However, the efficacy of Cerber is limited by the fact that it typically encrypts only Confluence data which may be well backed up in properly configured systems, reducing the incentive for victims to pay the ransom.

This development occurs in the context of an evolving ransomware landscape, with the emergence of new families like Evil Ant, HelloFire, and L00KUPRU, targeting Windows and VMware ESXi servers. Additionally, ransomware actors are leveraging leaked ransomware source code such as LockBit to create custom variants like Lambda, Mordor, and Zgut. The simplicity with which attackers can craft bespoke ransomware underscores the importance of robust security measures and a cybersecurity culture among employees to effectively mitigate these threats.