Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
A threat actor exploited an unpatched Confluence server using CVE-2023-22527, gaining initial access. They used Metasploit for command and control, then installed AnyDesk for persistent remote access. The attacker performed extensive network discovery, attempted privilege escalation using various techniques, and harvested credentials with tools like Mimikatz. They moved laterally using compromised domain admin credentials, accessing multiple systems via RDP and WMI. The intrusion culminated in the deployment of ELPACO-team ransomware, a Mimic variant, on key servers approximately 62 hours after initial access. While ransomware was deployed and some logs deleted, no significant data exfiltration was observed.
Pulse ID: 682aeeb0cc1b99346ea53ce7
Pulse Link: https://otx.alienvault.com/pulse/682aeeb0cc1b99346ea53ce7
Pulse Author: AlienVault
Created: 2025-05-19 08:41:19
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AnyDesk #Confluence #CyberSecurity #InfoSec #Mimic #OTX #OpenThreatExchange #RAT #RDP #RansomWare #bot #AlienVault
