---
title: Cerber Ransomware Linux Variant Exploiting CVE-2023-22518
description: A Linux variant of Cerber ransomware was observed exploiting CVE-2023-22518
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Cerber Ransomware Linux Variant Exploiting CVE-2023-22518](https://blog.polyswarm.io/cerber-ransomware-linux-variant-exploiting-cve-2023-22518)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Apr 22, 2024 6:02:42 PM

**Related Families:** Effluence

## **Executive Summary**

## A Linux variant of Cerber ransomware was observed exploiting CVE-2023-22518, a vulnerability affecting Atlassian Confluence.

**Key Takeaways**

- A Linux variant of Cerber ransomware was observed exploiting CVE-2023-22518, a vulnerability affecting Atlassian Confluence.
- Cerber ransomware has been active since at least 2016, and consists of three C++ payloads.
- CVE-2023-22518 is a critical vulnerability that results in improper authorization, allowing a threat actor to reset Confluence and create a Confluence administrator account. 

**What is the Cerber Linux Variant?**

A Linux variant of Cerber ransomware was observed exploiting CVE-2023-22518, a vulnerability affecting Atlassian Confluence. Cado Security recently [reported](https://www.cadosecurity.com/blog/cerber-ransomware-dissecting-the-three-heads) on this activity.

Cerber ransomware has been active since at least 2016. A Cerber variant was [observed](https://blog.polyswarm.io/c3rb3r-exploiting-cve-2023-22518) exploiting CVE-2023-22518 in late 2023. Cado Security more recently observed the Linux variant of Cerber being deployed after a threat actor exploited CVE-2023-22518, which is described in more detail below. 

Post exploitation, the threat actors uploaded and installed the Effluence web shell plugin to execute arbitrary commands on the victim machine. The threat actor used the web shell to download and run Cerber. Cerber consists of three C++ payloads. In the Linux variant, the payloads are compiled in ELF format and packed with UPX.

The primary payload is highly obfuscated and serves as a stager for additional payloads, which are retrieved from the C2. Upon execution, it deletes itself from the disk.  

The second payload is a log check payload. It attempts to write “success” to a particular field and appears to be used to check for sandboxing or to determine the malware’s permission level on the system. 

The third payload is an encryptor, which is used to encrypt system files. It looks for directories to encrypt, writes a ransom note in each directory, and overwrites files with their encrypted content, appending the .L0CK3D extension to the files. 

**What is CVE-2023-22518?**

[CVE-2023-22518](https://nvd.nist.gov/vuln/detail/CVE-2023-22518) is a critical vulnerability affecting Confluence Data Center and Server. It was first disclosed on October 31, 2023. The vulnerability results in improper authorization, allowing a threat actor to reset Confluence and create a Confluence administrator account. The threat actor can use the newly created account to perform administrative actions. Atlassian Cloud is not affected by this vulnerability.  

**IOCs**

PolySwarm has multiple samples of the Cerber Linux variant.

 

[4ed46b98d047f5ed26553c6f4fded7209933ca9632b998d265870e3557a5cdfe](https://polyswarm.network/scan/results/file/4ed46b98d047f5ed26553c6f4fded7209933ca9632b998d265870e3557a5cdfe)

[1849bc76e4f9f09fc6c88d5de1a7cb304f9bc9d338f5a823b7431694457345bd](https://polyswarm.network/scan/results/file/1849bc76e4f9f09fc6c88d5de1a7cb304f9bc9d338f5a823b7431694457345bd)

 

You can use the following CLI command to search for all Cerber samples in our portal:

**$ polyswarm link list -f Cerber**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) *|* [Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/cerber-ransomware-linux-variant-exploiting-cve-2023-22518)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2024-04-22T18:02:42.401Z",
  "datePublished" : "2024-04-22T18:02:42Z",
  "headline" : "Cerber Ransomware Linux Variant Exploiting CVE-2023-22518",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/CERBERRANDSOMWARE.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/cerber-ransomware-linux-variant-exploiting-cve-2023-22518",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```