Godzilla Backdoor Exploiting Confluence Vulnerability (Campaign)

Researchers discovered active exploitation of CVE-2023-22527 against Atlassian Confluence Data Center and Server, delivering a fileless in-memory backdoor dubbed "Godzilla" that uses AES-encrypted communications and injects a custom Tomcat valve to achieve unauthenticated remote code execution (CVSS 10). The backdoor resides entirely in memory and is difficult to detect; the report advises searching for indicators of compromise, removing identified files, and redeploying workloads from a known clean state.