CVE-2023-22527 Confluence Flaw Now Feeds Ransomware Attacks

A maximum-severity bug with a long tail

When Atlassian disclosed CVE-2023-22527 in its January 2024 security bulletin, it described the issue as a remote code execution vulnerability in out-of-date versions of Confluence Data Center and Server. 5 Since then, it has gone from a patch-now advisory to a documented starting point for full ransomware intrusions. Incident reports now trace attacks that begin with this single flaw and end with encrypted networks and stolen data.

The vulnerability carries a CVSS score of 10, the highest possible rating. It lets an unauthenticated attacker execute code remotely. 1 It is a template injection flaw affecting Confluence Data Center and Server versions 8.0.x through 8.4.x and 8.5.0 through 8.5.3. 4 Atlassian tracks it internally as CONFSERVER-93833, and it was reported through the company's bug bounty program by a researcher using the handle m1sn0w. 1

Exploited almost immediately

The usual gap between disclosure and weaponization barely existed here. By January 23, 2024, SOC Prime reported that the flaw was already being exploited in the wild, only days after it surfaced. 3 Greenbone noted that CISA had added CVE-2023-22527 to its Known Exploited Vulnerabilities catalog. That catalog is the U.S. government's list of flaws confirmed to be under active attack. 1

Greenbone also placed the bug in a wider context. It was the most severe of six high-severity Confluence vulnerabilities disclosed over a few months, with scores ranging from 7.5 to 10. 1 That run of disclosures matters for administrators. A Confluence instance missing one patch is often missing several.

From template injection to LockBit in two hours

The most detailed account of what happens after exploitation comes from The DFIR Report. It documented an intrusion that began with CVE-2023-22527 on an internet-exposed Windows Confluence server and ended with LockBit ransomware deployed across the environment. 2

The attacker followed a familiar sequence:

• Discovery: The first signs of activity were basic reconnaissance commands such as net user and whoami. 2
• Persistence and tooling: The attacker tried to pull down AnyDesk using curl. Mimikatz, Metasploit and AnyDesk all appeared during the intrusion. 2
• Lateral movement: RDP was the main way the attacker moved between systems. 2
• Exfiltration: Rclone was used to copy sensitive data to MEGA cloud storage. 2
• Deployment: LockBit was pushed out in several ways, including copying files over SMB shares for remote execution and distributing them automatically through PDQ Deploy, a legitimate software deployment tool. 2

The speed stands out most. The DFIR Report put the time to ransom at roughly two hours. 2 That leaves almost no room for a security team that relies on reviewing alerts the next morning.

A second ransomware crew, a year later

SOC Prime's May 2025 analysis shows this was not a one-off. It describes a separate campaign in which attackers exploited the same flaw on an unpatched, internet-facing Confluence server to deploy ELPACO-team ransomware, using RDP access as part of the operation. 4 The report stresses that attackers keep returning to known vulnerabilities as entry points. 4

The two accounts cover different ransomware families and were published more than a year apart, yet the pattern is the same. An exposed, outdated Confluence server gives an attacker code execution. RDP and commodity tools then carry that foothold to the rest of the network. Neither account required a novel exploit. The vulnerability was public, scored at maximum severity and listed by CISA well before both incidents were written up.

Why this keeps happening

Confluence is a collaboration platform. Organizations often expose it to the internet so staff and partners can reach it, and those same users depend on it every day. That makes it both reachable and awkward to take offline for upgrades. Self-managed Data Center and Server deployments also put the patching burden on customers. Atlassian's own bulletin frames the risk as affecting "out-of-date" versions. 5

The ransomware cases show a turning point for CVE-2023-22527. It began as an emergency fix and is now a routine tool for financially motivated groups. Once a flaw like this enters their standard playbooks, every unpatched server facing the internet becomes a target.

What defenders should take away

The priority is upgrading off the affected 8.x versions. Detection still has value for systems that cannot be fixed immediately or may already be compromised. Greenbone says its scanner can identify all of the recent Confluence vulnerabilities, including CVE-2023-22527. 1 SOC Prime has published Sigma rules aimed at exploitation attempts against web servers and at the ELPACO-team activity chain. 34

The DFIR Report timeline also suggests where to look after a breach. Watch for unexpected remote-access tools such as AnyDesk, credential-dumping activity, unusual RDP sessions, and legitimate admin tools like PDQ Deploy being used in unexpected ways. 2

With a two-hour window between entry and encryption, the most reliable defense is to remove the entry point by patching before attackers find it.