The attack chain involves exploiting vulnerable Confluence servers to fetch and execute ransomware payloads. GreyNoise data shows these attacks originate from IP addresses in France, Hong Kong, and Russia. Arctic Wolf Labs reported a severe remote code execution flaw in Apache ActiveMQ (CVE-2023-46604), being used to deliver SparkRAT and a ransomware variant resembling TellYouThePass.

Huntress confirmed the Atlassian flaw exploitation since November 3, leading to Cerber ransomware infections. The rapidity of these campaigns, from patch release to exploitation, highlights the adversaries’ speed in monetizing vulnerabilities.

Confluence is targeted due to its widespread use in collaboration, making it a prime target for accessing sensitive information and spreading malware. Rapid7’s Managed Detection and Response (MDR) service detected the exploitation of these flaws, affecting both Windows and Linux platforms, with attackers using Python Base64 instructions to download malicious payloads.

Atlassian has released fixed versions of Confluence to address these vulnerabilities, and while Atlassian Cloud users are safe, others with vulnerable sites are urged to update immediately. If updates are not feasible, Atlassian recommends interim risk mitigation measures. The firm also provided information on Indicators of Compromise (IOCs), including IP addresses, domains, file hashes, and ransom notes, to assist in identifying and responding to these threats.