Attackers Exploit Critical Atlassian Confluence Flaw for Cryptojacking

Trend Micro observed active exploitation of Atlassian Confluence CVE-2023-22527 (CVSS 10.0) in cryptojacking campaigns where attackers achieve unauthenticated RCE to deploy XMRig miners (via ELF payloads or SSH-delivered shell scripts), kill competing miners, disable cloud security (e.g., Alibaba Cloud Shield), gather credentials and IPs for SSH lateral movement, and maintain persistence through cron jobs; defenders are urged to patch, segment networks, and perform audits and incident response planning.