Muhstik Takes Aim at Confluence CVE 2021-26084
Key Takeaways
- In line with USCYBERCOM’s warning, publicly available Confluence exploit scripts are being integrated into opportunistic attackers’ toolkits.
- Muhstik, a known threat actor targeting cloud and IoT, is one of these opportunistic attackers targeting vulnerable Confluence servers to spread their botnet.
- Lacework Labs observed bash droppers with zero detections on VirusTotal being used in conjunction with CVE 2021-26084.
Background
Early on Sept. 3, 2021, the USCYBERCOM Twitter account alerted followers to urgently patch Atlassian Confluence CVE-2021-26084 before the labor-day holiday weekend, citing mass exploitation. Since that warning, the Lacework Labs Team has observed a number of exploit attempts using the publicly available exploit code. This blog details the malware, architecture, and infrastructure used in these attacks.
Execution Flow Analysis
Publicly available exploit scripts reportedly emerged less than a week following the announcement of CVE-2021-26084 on Aug. 25, 2021. These scripts enable the attacker to gain shell access on the remote server. Simple modifications to this script enabled opportunistic attackers to take a “spray and pray” approach, attempting to spread their malware to several hosts as quickly as possible. Initial execution was achieved via a specially crafted HTTP post request to a vulnerable instance of Confluence.
On Sept. 4, the following exploit traffic was observed in Lacework honeypots originating from IPs 213.16.63.201 (ASN 8866 Viacom) & 62.38.35.226 (ASN 3329 Vodafone-panafon Hellenic Telecommunications Company SA). Lacework Labs first observed IP 213.16.63.201 on July 16, in Redis scanning activity against port 6379. IP 62.38.35.226, and also previously observed in mid-August performing curl requests on port 80.
 |
Figure 1. Honeypot traffic
After the initial execution of the CVE-2021-26084 payload, a wget or curl command was executed to download conf2 from 194.31.52.174. This file contained additional download commands for dk86, dk32, and ldm payloads, in addition to changing default iptables policies to be ACCEPT and flushing any existing rules. This behavior can be observed in Figure – 1 below.
 |
Figure 2. conf Dropper
The dk86 and dk32 ELF binaries were packed with a custom UPX utility and have hardcoded string references to Anime. This aligns to a threat actor group Lacework Labs has previously reported on, Muhstik. Muhstik leveraged well known vulnerabilities in web applications to expand their IoT botnet. Given previous behavior by this actor, it appears the latest Confluence vulnerability is another target on their list.
 |
Figure 3 – Anime String References in Muhstik
The ldm script hosted on a separate server than conf2 and dk86/dk32 was a more advanced dropper script that performed the following tasks:
- Established persistence via crontab (T1053.003)
- Established persistence via dropped ssh key (T1098.004)
- Attempt lateral movement via existing ssh keys, users and host entries in ~/.ssh/known_hosts (T1021.004)
- Downloaded additional dropper scripts for pty payloads. (T1059.004)
- Download additional payloads from .onion sites
 |
Figure 4 – Download Script: x3.sh
 |
Figure 5 – Multi Architecture
The entire execution workflow can be seen in Figure 6 below.
 |
Figure 6 – Confluence RCE Overview
Bot Analysis
The pty binaries identified within this campaign are IRC bots that appear to be modified versions of Tsunami/Katien. All of the identified binaries include modification of the UPX header to prevent easy unpacking via the upx utility. These binaries can be patched by replacing the custom header bytes (0a 00 00 00) with the bytes for the valid UPX! header (55 50 58 21). A script for patching these files is available in the Lacework Labs Github repository. After patching the upx utility can be used to unpack these binaries.
The pty IRC bots are compiled for numerous architectures including ARM, MIPS, x86, and x64. All of the pty IRC bots are statically compiled, while a subset are compiled with OpenSSL drastically increasing the file size. The main functionality of the IRC bots includes DoS commands for various protocols, as well as ssh brute forcing and raw sh command execution. This functionality can be seen in the bot’s help menu listed below.
 |
Figure 7 – Bot’s help menu
In conjunction with the HTTP flooding and brute force attacks, multiple hard coded usernames, passwords, and user-agent strings are embedded within the binaries. The image below shows embedded User-Agent strings identified within the x86 pty IRC bot variant.
 |
Figure 8 – Embedded User-Agents
Each pty sample contains a single byte XOR (key 0x22) encrypted configuration section, which contains the domains/IPs the IRC bots connect to. All variants contained the same decoded configuration:
"irc.de-za" "listening tun0 "165.22.217.181 "162.249.2.189 "185.62.137.56 "68.66.253.100 "46.149.233.35 "185.61.149.22 "45.132.242.233 "173.255.240.191 "31.131.24.229 "i.l33t-ppl.info "i.de-zahlung.eu "i.deutschland-zahlung.net "i.shadow-mods.net "i.deutschland-zahlung.eu "/proc/ "/exe "/status "/fd "\x58\x4D\x4E\x4E\x43\x50\x46\x22 "zollard "muhstik-11052018 "eth1 "lan0 "eth0 "inet0 "lano
Most of the IPs in the observed configuration have links to previously observed Muhstik domains, while others do not. The following tables show these hosts along with historic passive DNS resolutions.
| IP | ASN | country | Domains from passive DNS |
| 162.249.2.189 | 55293:”A2HOSTING” | United States | ead.fflyy.su grand.fflyy.su dead.fflyy.su postmaster.fflyy.su kei.su w.deutschland-zahlung.eu fucks.fflyy.su wireless.kei.su irc.de-zahlung.eu fflyy.su butt.fflyy.su paypal.com-nl-cgi-bin-webscr-cmd-verify-submit.fflyy.su wired.kei.su |
| 165.22.217.181 | 14061:”DIGITALOCEAN-ASN” | India | pokemoninc.com irc.deutschland-zahlung.net www.ancianossupervisados.com server1.pokemoninc.com xxx.pokemoninc.com api.mahasarkar.co.in nctbsolution.com irc.de-zahlung.eu pex.pokemoninc.com proceso.pokemoninc.com netexplanations.com app.mahasarkar.co.in m.mahasarkar.co.in www.netexplanations.com ancianossupervisados.com televisa.pokemoninc.com jorgee3.pokemoninc.com dns5.name-services.com.pokemoninc.com shit.pokemoninc.com aid.pokemoninc.com answergyaan.in ftp.pokemoninc.com romero.pokemoninc.com mail.pokemoninc.com server.mahasarkar.co.in bnet.pokemoninc.com |
| 173.255.240.191 | 63949:”Linode, LLC” | United States | li250-191.members.linode.com irc.de-zahlung.eu |
| 185.61.149.22 | 43513:”Sia Nano IT” | Latvia | x.fd6fq54s6df541q23sdxfg.eu irc.de-zahlung.eu irc.deutschland-zahlung.net |
| 185.62.137.56 | 55293:”A2HOSTING” | United States | jaygame.net irc.de-zahlung.eu |
| 31.131.24.229 | 56851:”PE Skurykhin Mukola Volodumurovuch” | Ukraine | vaua0055033.online-vm.com |
| 45.132.242.233 | 47583:”Hostinger International Limited” | Germany | amaismarket.com.br ns1.amaismarket.com.br webmail.clinicaajudaanimal.com.br _dc-mx.d88c97daf3cd.comercionarede.com.br exposedbotnets.ru bcjservice.com.br mail.espartana.com.br ftp.tudodearte.com.br clinicaajudaanimal.com.br |
| 46.149.233.35 | 52175:”Magellan Telecom Kuzbass Ltd.” | Russia | emsib.ru host233-35.mgtelecom.ru |
| 68.66.253.100 | 55293:”A2HOSTING” | United States | irc.de-zahlung.eu uranus.kei.su |
Also, according to passive DNS, the domains in the configuration with the ‘i’ subdomains have never been resolved to any hosts. However, some of these have additional subdomains worth noting.
- edsux.i.shadow-mods.net
- hacku.i.shadow-mods.net
- irc.i.shadow-mods.net
- xmr.i.shadow-mods.net
- goahead.i.deutschland-zahlung.eu
- tomato.i.deutschland-zahlung.eu
- irc7.i.shadow-mods.net
- dasan.i.deutschland-zahlung.eu
- l33t.i.shadow-mods.net
Recommended Actions
While origins of the vulnerability have not been officially confirmed, Confluence did release a security advisory detailing the specifics. The advisory notes Confluence Server and Data Center versions before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5 are affected by this vulnerability. Confluence Cloud versions of the products are not vulnerable. The vulnerability ultimately allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance, providing a prime opportunity for opportunistic and targeted attackers as an entry point into target networks. Some additional background also may be found in an outside vulnerability research blog describing the original bug reporting effort.
Some recommended actions:
- Follow the official Confluence advisory for the most current technical recommendations, including patching and configuration updates.
- If your organization was vulnerable over the weekend, perform an incident response effort to evaluate any potential compromise with the help of this blog and IOCs below.
Indicators
| IOCs | Context |
| 213.16.63.201 | Exploit source |
| 62.38.35.226 | Exploit source |
| bvprzqhoz72jltin.onion | C2 |
| bvprzqhoz72jltin.tor2web.su | C2 |
| bvprzqhoz72jltin.onion.ly | C2 |
| bvprzqhoz72jltin.onion.ws | C2 |
| 194.31.52.174 | Conf2 dropper Hosting Site |
| 18.235.127.50 | Ldm Malware staging |
| 32.221.40.237 | Hosting pty payloads |
| a91dffe65048e39dfe1fd8da0b0dac11807718cdd5efedf4206a18af78779b0a | File: conf2 |
| b3a6fe5bc3883fd26c682bb6271a700b8a6fe006ad8df6c09cc87530fcd3a778 | 34.221.40.237/.x/pty8 |
| 2a4e636c4077b493868ea696db3be864126d1066cdc95131f522a4c9f5fb3fec | 34.221.40.237/.x/pty9 |
| c38f0f809a1d8c50aafc2f13185df1441345f83f6eb4ef9c48270b9bd90c6799 | 34.221.40.237/.x/pty4 |
| 6370939d4ff51b934b7a2674ee7307ed06111ab3b896a8847d16107558f58e5b | 34.221.40.237/.x/pty10 |
| a3f72a73e146834b43dab8833e0a9cfee6d08843a4c23fdf425295e53517afce | 34.221.40.237/.x/pty3 |
| b55ddbaee7abf1c73570d6543dd108df0580b08f730de299579570c23b3078c0 | 34.221.40.237/.x/1sh |
| 6a8965a0f897539cc06fefe65d1a4c5fa450d002d1a9d5d69d2b48f697ee5c05 | 34.221.40.237/.x/pty6 |
| e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80 | 34.221.40.237/.x/pty1 |
| 63d43e5b292b806e857470e53412310ad7103432ba3390ecd4f74e432530a8a9 | 34.221.40.237/.x/pty11 |
| 715f1f821d028e165bfa750d73505f1a6136184999411300cc88c18ebfa6e8f7 | 34.221.40.237/.x/pty2 |
| c154d739cab62e958944bb4ac5ebad6e965a0442a3f1c1d99d56137e3efa8e40 | 34.221.40.237/.x/pty7 |
| 19370ef36f43904a57a667839727c09c50d5e94df43b9cfb3183ba766c4eae3d | 34.221.40.237/.x/pty5 |
| 5c46098887e488d91f42c6d9b93b17b2736c9f4cb5a4a1e476c87c0d310a3f28 | 34.221.40.237/.x/3sh |
| 0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049 | 194.31.52.174/dk86 |
| fe98548300025a46de1e06b94252af601a215b985dad31353596af3c1813efb0 | 194.31.52.174/dk32 |
| 39db1c54c3cc6ae73a09dd0a9e727873c84217e8f3f00e357785fba710f98129 | 18.235.127.50/ldm |
