www.trendmicro.com
Open in
urlscan Pro
2.19.216.164
Public Scan
URL:
https://www.trendmicro.com/en_us/research/22/i/atlassian-confluence-vulnerability-cve-2022-26134-abused-for-cryptocurrency-...
Submission: On June 11 via api from IN — Scanned from DE
Submission: On June 11 via api from IN — Scanned from DE
Form analysis
1 forms found in the DOM<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>
Text Content
Business search close * Solutions * By Challenge * By Challenge * By Challenge Learn more * Understand, Prioritize & Mitigate Risks * Understand, Prioritize & Mitigate Risks Improve your risk posture with attack surface management Learn more * Protect Cloud-Native Apps * Protect Cloud-Native Apps Security that enables business outcomes Learn more * Protect Your Hybrid World * Protect Your Hybrid, Multi-Cloud World Gain visibility and meet business needs with security Learn more * Securing Your Borderless Workforce * Securing Your Borderless Workforce Connect with confidence from anywhere, on any device Learn more * Eliminate Network Blind Spots * Eliminate Network Blind Spots Secure users and key operations throughout your environment Learn more * See More. Respond Faster. * See More. Respond Faster. Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities Learn more * Extend Your Team * Extend Your Team. Respond to Threats Agilely Maximize effectiveness with proactive risk reduction and managed services Learn more * Operationalizing Zero Trust * Operationalizing Zero Trust Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console Learn more * By Role * By Role * By Role Learn more * CISO * CISO Drive business value with measurable cybersecurity outcomes Learn more * SOC Manager * SOC Manager See more, act faster Learn more * Infrastructure Manager * Infrastructure Manager Evolve your security to mitigate threats quickly and effectively Learn more * Cloud Builder and Developer * Cloud Builder and Developer Ensure code runs only as intended Learn more * Cloud Security Ops * Cloud Security Ops Gain visibility and control with security designed for cloud environments Learn more * By Industry * By Industry * By Industry Learn more * Healthcare * Healthcare Protect patient data, devices, and networks while meeting regulations Learn more * Manufacturing * Manufacturing Protecting your factory environments – from traditional devices to state-of-the-art infrastructures Learn more * Oil & Gas * Oil & Gas ICS/OT Security for the oil and gas utility industry Learn more * Electric Utility * Electric Utility ICS/OT Security for the electric utility Learn more * Federal * Federal Learn more * Automotive * Automotive Learn more * 5G Networks * 5G Networks Learn more * Small & Midsized Business Security * Small & Midsized Business Security Stop threats with comprehensive, set-it-and-forget-it protection Learn more * Platform * Vision One Platform * Vision One Platform * Trend Vision One Our Unified Platform Bridge threat protection and cyber risk management Learn more * AI Companion * Trend Vision One Companion Your generative AI cybersecurity assistant Learn more * Attack Surface Management * Attack Surface Management Stop breaches before they happen Learn more * XDR (Extended Detection & Response) * XDR (Extended Detection & Response) Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Cloud Security * Cloud Security * Trend Vision One™ Cloud Security Overview The most trusted cloud security platform for developers, security teams, and businesses Learn more * Attack Surface Risk Management for Cloud * Attack Surface Risk Management for Cloud Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one Learn more * XDR for Cloud * XDR for Cloud Extend visibility to the cloud and streamline SOC investigations Learn more * Workload Security * Workload Security Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities Learn more * Container Security * Container Security Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection Learn more * File Security * File Security Protect application workflow and cloud storage against advanced threats Learn more * Endpoint Security * Endpoint Security * Endpoint Security Overview Defend the endpoint through every stage of an attack Learn more * XDR for Endpoint * XDR for Endpoint Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Workload Security * Workload Security Optimized prevention, detection, and response for endpoints, servers, and cloud workloads Learn more * Industrial Endpoint Security * Industrial Endpoint Security Learn more * Mobile Security * Mobile Security On-premises and cloud protection against malware, malicious applications, and other mobile threats Learn more * Network Security * Network Security * Network Security Overview Expand the power of XDR with network detection and response Learn more * XDR for Network * XDR for Network Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Network Intrusion Prevention (IPS) * Network Intrusion Prevention (IPS) Protect against known, unknown, and undisclosed vulnerabilities in your network Learn more * Breach Detection System (BDS) * Breach Detection System (BDS) Detect and respond to targeted attacks moving inbound, outbound, and laterally Learn more * Secure Service Edge (SSE) * Secure Service Edge (SSE) Redefine trust and secure digital transformation with continuous risk assessments Learn more * Industrial Network Security * Industrial Network Security Learn more * 5G Network Security * 5G Network Security Learn more * Email Security * Email Security * Email Security Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise Learn more * Email and Collaboration Security * Trend Vision One™ Email and Collaboration Security Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace Learn more * OT Security * OT Security * OT Security Learn about solutions for ICS / OT security. Learn more * XDR for OT * XDR for OT Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Industrial Network Security * Industrial Network Security Industrial Network Security * Industrial Endpoint Security * Industrial Endpoint Security Learn more * Threat Intelligence * Threat Intelligence Keep ahead of the latest threats and protect your critical data with ongoing threat prevention and analysis Learn more * Identity Security * Identity Security End-to-end identity security from identity posture management to detection and response Learn more * On-Premises Data Sovereignty * On-Premises Data Sovereignty Prevent, detect, respond and protect without compromising data sovereignty Learn more * All Products, Services, and Trials * All Products, Services, and Trials Learn more * Research * Research * Research * Research Learn more * Research, News, and Perspectives * Research, News, and Perspectives Learn more * Research and Analysis * Research and Analysis Learn more * Security News * Security News Learn more * Zero Day Initiatives (ZDI) * Zero Day Initiatives (ZDI) Learn more * Services * Our Services * Our Services * Our Services Learn more * Service Packages * Service Packages Augment security teams with 24/7/365 managed detection, response, and support Learn more * Managed XDR * Managed XDR Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks Learn more * Incident Response * Incident Response * Incident Response Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans Learn more * Insurance Carriers and Law Firms * Insurance Carriers and Law Firms Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs Learn more * Support Services * Support Services Learn more * Partners * Partner Program * Partner Program * Partner Program Overview Grow your business and protect your customers with the best-in-class complete, multilayered security Learn more * Managed Security Service Provider * Managed Security Service Provider Deliver modern security operations services with our industry-leading XDR Learn more * Managed Service Provider * Managed Service Provider Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs Learn more * Cloud Service Provider * Cloud Service Provider Add market-leading security to your cloud service offerings – no matter which platform you use Learn more * Professional Services * Professional Services Increase revenue with industry-leading security Learn more * Resellers * Resellers Discover the possibilities Learn more * Marketplace * Marketplace Learn more * System Integrators * System Integrators Learn more * Alliance Partners * Alliance Partners * Alliance Overview We work with the best to help you optimize performance and value Learn more * Technology Alliance Partners * Technology Alliance Partners Learn more * Our Alliance Partners * Our Alliance Partners Learn more * Partner Tools * Partner Tools * Partner Tools Learn more * Partner Login * Partner Login Login * Education and Certification * Education and Certification Learn more * Partner Successes * Partner Successes Learn more * Distributors * Distributors Learn more * Find a Partner * Find a Partner Learn more * Company * Why Trend Micro * Why Trend Micro * Why Trend Micro Learn more * Customer Success Stories * Customer Success Stories Learn more * The Human Connection * The Human Connection Learn more * Industry Accolades * Industry Accolades Learn more * Strategic Alliances * Strategic Alliances Learn more * Compare Trend Micro * Compare Trend Micro * Compare Trend Micro See how Trend outperforms the competition Let's go * vs. Crowdstrike * Trend Micro vs. Crowdstrike Crowdstrike provides effective cybersecurity through its cloud-native platform, but its pricing may stretch budgets, especially for organizations seeking cost-effective scalability through a true single platform Let's go * vs. Microsoft * Trend Micro vs. Microsoft Microsoft offers a foundational layer of protection, yet it often requires supplemental solutions to fully address customers' security problems Let's go * vs. Palo Alto Networks * Trend Micro vs. Palo Alto Networks Palo Alto Networks delivers advanced cybersecurity solutions, but navigating its comprehensive suite can be complex and unlocking all capabilities requires significant investment Let's go * About Us * About Us * About Us Learn more * Trust Center * Trust Center Learn more * History * History Learn more * Diversity, Equity and Inclusion * Diversity, Equity and Inclusion Learn more * Corporate Social Responsibility * Corporate Social Responsibility Learn more * Leadership * Leadership Learn more * Security Experts * Security Experts Learn more * Internet Safety and Cybersecurity Education * Internet Safety and Cybersecurity Education Learn more * Legal * Legal Learn more * Investors * Investors Learn more * Formula E Racing * Formula E Racing Learn more * Connect With Us * Connect With Us * Connect With Us Learn more * Newsroom * Newsroom Learn more * Events * Events Learn more * Careers * Careers Learn more * Webinars * Webinars Learn more Back Back Back Back * Free Trials * Contact Us Looking for home solutions? Under Attack? 3 Alerts Back Unread All * Ransomware in Q1 2024: Report on Phobos, LockBit, and other critical threats close Read report > * Deepfakes and AI-driven disinformation threaten polls close Get the facts > * Report on the email threat landscape close Learn the latest defense strategies > Folio (0) Support * Business Support Portal * Business Community * Virus and Threat Help * Education and Certification * Contact Support * Find a Support Partner Resources * Trend Micro vs. Competition * Cyber Risk Index/Assessment * CISO Resource Center * DevOps Resource Center * What Is? * Threat Encyclopedia * Cloud Health Assessment * Cyber Insurance * Glossary of Terms * Webinars Log In * Vision One * Support * Partner Portal * Cloud One * Product Activation and Management * Referral Affiliate Back arrow_back search close Content has been added to your Folio Go to Folio (0) close Exploits & Vulnerabilities ATLASSIAN CONFLUENCE VULNERABILITY CVE-2022-26134 ABUSED FOR CRYPTOCURRENCY MINING, OTHER MALWARE Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining. By: Sunil Bharti September 21, 2022 Read time: 6 min (1646 words) Save to Folio Subscribe -------------------------------------------------------------------------------- We observed the active exploitation of CVE-2022-26134, an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining. Confluence has already released a security advisory detailing the fixes necessary for all affected products, namely all versions of Confluence Server and Confluence Data Center. If left unremedied and successfully exploited, this vulnerability could be used for multiple and more malicious attacks, such as a complete domain takeover of the infrastructure and the deployment information stealers, remote access trojans (RATs), and ransomware. Users and organizations are advised to upgrade to the fixed versions, apply the available patches, or to apply temporary fixes as soon as possible to mitigate the risks of abuse. Abusing the gap Figure 1. Infection chain The vulnerability can be exploited by sending a specially crafted HTTP request containing an Object-Graph Navigation Language (OGNL) expression in the HTTP request Uniform Resource Identifier (URI) to the victim server, resulting in an RCE. To identify whether the installed Confluence Server is vulnerable, the attacker can send an HTTP request to run an id command. Upon successful exploitation, the attacker can read its response in a controlled HTTP response header. From the sample we analyzed, executing the id command yielded an output of “X-Cmd-Response" header — the vulnerable server will execute the command and set its response in the attacker-defined header. Figure 2. Attacker sends a malicious request to check for user information Figure 3. The response to the attacker’s malicious request Looking at the malware routine Using Trend Micro Cloud One™ Workload Security modules to track the components and activities of the cryptocurrency malware used, we observed the following events and components: * Intrusion Prevention System (IPS): Aside from blocking the exploitation of CVE-2022-26134 and other application vulnerabilities, IPS also tracked the incoming event’s traffic and the payload’s data and trigger. In this sample, the attacker injected an OGNL expression to download and run the ro.sh script in the victim’s machine. This script file downloaded another script, ap.sh. Figure 4. IPS event on attack traffic Figure 5. Payload data captured * Web reputation module: Aside from blocking the malicious URL, we also observed the command-and-control (C&C) URL server that the malware was communicating with for the payload download routine. Figure 6. Blocking the malicious URL * Antimalware module: Aside from protecting the targeted system against the exploitation of the vulnerability in real time using behavior monitoring, the antimalware module can also detect and block the download of other components to execute the malware. In this sample, the scripts were downloading the cryptocurrency miner malware hezb. Figure 7. Detecting the malicious cryptocurrency miner * Activity monitoring module: This module detects process, file, and network activities on endpoints running Workload Security. From our analysis, the hezb malware initiated a process to communicate with the C&C server. Figure 8. Telemetry event of a process initiated by the hezb malware Tracking the shell scripts Once the exploit payload is executed in the victim machine, the malware downloads the ro.sh/ap.sh shell script file. This shell script performs multiple actions and we break it down as follows: 1. The script updates the path variable to include the /tmp and /dev/shm paths. Figure 9. Updating the path variable 2. If the curl utility is not present in the system, the script downloads and installs its own curl binary file from the C&C server. Figure 10. Function to download the scripts and binaries 3. Like many other cryptocurrency-mining malware, it disables the iptables or changes the firewall policy action to ACCEPT and flushes all the firewall rules. Figure 11. Disabling the firewall 4. The script downloads a binary file ko, which takes the advantage of the PwnKit vulnerability to escalate the privilege to the root user, while the binary file downloads the ap.sh shell script for the next actions. Figure 12. Script downloading other resources 5. The ap.sh script downloads the hezb malware and kills multiple processes that belong to other competing coin miners, disables cloud service provider agents, and proceeds with lateral movement. Figure 13. Disabling cloud service provider agents a. The ap.sh script checks for the presence of hezb in the running process. If it is not found, the script downloads the binary file according to the system architecture (such as sys.x86_64), renames it to “hezb", and communicates with its C&C server hosted at 106[.]252[.]252[.]226 using port 4545. Figure 14. Downloading the malicious cryptocurrency miner Figure 15. Detection of hezb connecting to its C&C server using Trend Micro Vision One™ b. Under the /root and /home directories, the script scans for secure shell protocol (SSH) users, keys, and hosts in the .ssh directory and .bash_history file. Figure 16. Collecting information for lateral movement via SSH While doing lateral movement via SSH, the malware also downloads the ldr.sh script on the remote hosts. ldr.sh contains the hard-coded information of the miner wallet address that it needs to communicate with. Upon closer examination, we can see that the ldr.sh script has the same content as ro.sh and ap.sh, except for the process where the script simultaneously connects with the miner server and uses different IP addresses and arguments. Figure 17. Miner connecting to C&C server Figure 18. Detection of vulnerability exploitation by observed attack techniques (OATs) Figure 19. Trend Micro Vision One Workbench app detection of correlated events We analyzed the script capable of changing the attribute of </etc/ld.so.preload> to make it mutable. </etc/ld.so.preload> does not commonly exist in the usual installation of Linux. The presence of this file and other paths to arbitrary executables could indicate malicious libraries, which also imply the presence of other malware. Making the file mutable clears the contents of the file by changing the file permissions to free the system’s resource because other malicious processes will be unable to work. We also observed that it can scan the status of all mounted file systems in the </proc/mount> directory. Figure 20. Tracking the telemetry activity of changing attributes with the Workbench app’s Execution Profile feature Conclusion Although we have observed the abuse of this vulnerability for illicit cryptocurrency-mining activities by cybercriminals, we also urge users to prioritize patching this gap as soon as possible since it is fairly simple to exploit it for other subsequent compromises. Attackers could take advantage of injecting their own code for interpretation and gain access to the Confluence domain being targeted, as well as conduct attacks ranging from controlling the server for subsequent malicious activities to damaging the infrastructure itself. Aside from the hezb malware, we observed Kinsing and the Dark.IoT malware from our honeypot abusing this vulnerability. Reports of cybercriminals exploiting this gap in attempts to deploy malware such as Mirai and web shells such as China Chopper have also emerged, with analyses detailing the abuse of vulnerable servers to spread and expand attacks. We’ve observed a number of companies who have been hit with the active exploitation of CVE-2022-26134. According to Confluence’s website, over 75,000 customers use the collaboration tool for their business and work operations, which implies that a number of industries could be vulnerable and overwhelmed with attacks if their respective platforms remain unpatched. Organizations who have yet to patch or upgrade their respective subscriptions to a fixed version are advised to apply the recommended mitigation steps from the official documentation released. Trend Micro solutions Trend Micro Vision One™ customers are protected from the abuse of this vulnerability and its accompanying malicious payloads via Workload Security with the following rules: * 1011456: Atlassian Confluence and Data Center Remote Code Execution Vulnerability (CVE-2022-26134) * 1008610: Block Object-Graph Navigation Language (OGNL) Expressions Initiation in Apache Struts HTTP Request Workload Security’s correlation of telemetry and detections provide initial security context, allowing security teams and analysts to track and monitor the threats activities. In the next section, Trend Micro Vision One provides more details into the paths and events in real time. Using Trend Micro Vision One, the observed attack techniques (OATs) is generated from individual events that provide security teams and analysts with security value. To investigate the possible attempts of exploitation using this vulnerability, analysts can look for these OAT IDs from the other helper OAT triggers indicative of suspicious activities on the affected host, such as: 1. F2588 - Atlassian Vulnerability Exploitation 2. F2358 - Recursive File Deletion via RM Command 3. F2360 - Process Discovery via PS command 4. F4584 - Identified Transfer of Suspicious Files Over Network 5. F3737 - Curl Execution 6. F4868 - Wget Execution 7. F2918 - View File via Cat Command 8. F4986 - Malware Detection 9. F2140 - Malicious Software 10. F2681 - Display Users and Groups List 11. F2763 - Malicious URL The Trend Micro Vision One Workbench app helps analysts see the significant correlated events intelligently based on occurrences throughout the entire fleet of workloads. Analysts can view the different fields of interest that are considered important and provide security value, allowing security teams to see the compromised assets and isolate those that can be potentially affected while patching procedures are in progress. Using the Execution Profile feature in Vision One, analysts can through the extensive list of actions performed by an adversary from the search app or the threat hunting app to look for different activities observed in a given time frame. Indicators of Compromise (IOCs) You can find the full list of IOCs here. MITRE ATT&CK Techniques Technique ID Exploit Public-Facing Application T1190 Hijack Execution Flow: Path Interception by PATH Environment Variable T1574.007 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification T1222.002 Hide Artifacts: Hidden Files and Directories T1564.001 Software Discovery T1518 Impair Defenses: Disable or Modify System Firewall T1562.004 Indicator Removal on Host: File Deletion T1070.004 Scheduled Task/Job: Cron T1053.003 Resource Hijacking T1496 System Information Discovery T1082 Remote System Discovery T1018 Remote Services: SSH T1021.004 Tags Malware | Cyber Crime | Exploits & Vulnerabilities | Cyber Threats | Endpoints | Mobile | Articles, News, Reports AUTHORS * Sunil Bharti Senior Threat Researcher Contact Us Subscribe RELATED ARTICLES * Cybersecurity Decluttered: A Journey to Consolidation * Noodle RAT: Reviewing the New Backdoor Used by Chinese-Speaking Groups * Manage Open Source Code Security Risks See all articles Try our services free for 30 days * Start your free trial today * * * * * RESOURCES * Blog * Newsroom * Threat Reports * DevOps Resource Center * CISO Resource Center * Find a Partner SUPPORT * Business Support Portal * Contact Us * Downloads * Free Trials * * ABOUT TREND * About Us * Careers * Locations * Upcoming Events * Trust Center * Country Headquarters Trend Micro - United States (US) 225 East John Carpenter Freeway Suite 1500 Irving, Texas 75062 Phone: +1 (817) 569-8900 Select a country / region United States expand_more close THE AMERICAS * United States * Brasil * Canada * México MIDDLE EAST & AFRICA * South Africa * Middle East and North Africa EUROPE * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom ASIA & PACIFIC * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam Privacy | Legal | Accessibility | Site map Copyright ©2024 Trend Micro Incorporated. All rights reserved sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk This website uses cookies for website functionality, traffic analytics, personalization, social media functionality and advertising. Our Cookie Notice provides more information and explains how to amend your cookie settings.Learn more Cookies Settings Accept ✓ Danke für das Teilen! AddToAny Mehr… word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1Sumo