Where are they now? Starring: Atlassian's Confluence CVE-2023-22527 | Grey Noise Blog
Summary: GreyNoise Labs published a blog examining CVE-2023-22527, an Atlassian Confluence vulnerability that drew widespread news coverage in January 2024 and was largely dropped by media a week later. The Labs team reports that attackers continue to exploit it, and describes their techniques: killing other malware, deleting log files, and using SSH keys to infect other hosts.
Bottom line: The vulnerability left the headlines in a week, but the attackers did not - and once on a host they delete logs and use SSH keys to spread to other machines, which is the kind of activity that erases the evidence you would need to scope the incident.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-22527
- Related
- CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability Known Exploited Vulnerabilities · Jan 24, 2024Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026