Ransomware gangs are actively exploiting CVE-2022-26134 remote code execution (RCE) flaw in Atlassian Confluence Server and Data Center.

Multiple ransomware groups are actively exploiting the recently disclosed remote code execution (RCE) vulnerability, tracked as CVE-2022-26134, affecting Atlassian Confluence Server and Data Center.

Proof-of-concept exploits for the CVE-2022-26134 vulnerability have been released online, Bleeping Computer reported that starting from Friday afternoon, a proof-of-concept exploit for this issue was publicly shared. Researchers from cybersecurity firm GreyNoise reported that 23 unique IP addresses were observed exploiting the Atlassian vulnerabilities.

A remote attacker could exploit this OGNL injection vulnerability to take over vulnerable servers, then exploit the remote code execution to implant malware, including ransomware.

Researchers from security firm Prodaft first reported that AvosLocker ransomware operators have already started exploiting the Atlassian Confluence bug, BleepingComputer reported.

The researchers noticed the creation of a “confluence campaign” in the control panel of the AvosLocker operation.

BleepingComputer also reported that operators behind Cerber2021 ransomware (aka CerberImposter) are actively exploiting the Confluence flaw in recent attacks.

Below is data shared by ID-Ransomware creator Michael Gillespie (@demonslay335) with BleepingComputert that shows submissions of CerberImposter including encrypted Confluence configuration files.

Atlassian confluence Cerber


[출처 : SecurityAffairs / 6.12.]