---
title: "Confluence to Cerber: Exploitation of ​​CVE-2023-22518"
url: https://daily.dev/posts/confluence-to-cerber-exploitation-of-cve-2023-22518-6bdcbmhg5
source_url: https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
type: article
source: "Huntress Blog"
published: 2026-05-31T07:43:37.379Z
updated: 2026-05-31T08:59:57.658Z
tags: ["tech-news", "ransomware", "powershell"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Confluence to Cerber: Exploitation of ​​CVE-2023-22518

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 5 min read · 0 upvotes · 0 comments

## Summary

Huntress confirmed active exploitation of CVE-2023-22518, an improper authorization vulnerability in Atlassian Confluence Data Center and Server, beginning November 3, 2023 — just days after Atlassian released patches. Attackers exploited the unauthenticated /json/setup-restore.action endpoint to inject a malicious admin user, then deployed Cerber ransomware (C3RB3R) via encoded PowerShell commands that downloaded and executed a hex-encoded PE payload. The attack chain involved creating a new admin account, installing a web shell plugin, and dropping ransomware that appends 'L0CK3D' to encrypted files. Mitigation guidance includes immediate patching, attack surface minimization, placing Confluence behind VPNs, and maintaining defense-in-depth postures to detect post-exploitation activity.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment>

## Similar posts on daily.dev

- [Unknown attackers exploit another critical SharePoint bug](https://daily.dev/posts/unknown-attackers-exploit-another-critical-sharepoint-bug-wlvkhutcz) · The Register · 0 upvotes · 0 comments
- [Hackers leverage new Microsoft SharePoint exploit in attacks](https://daily.dev/posts/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks-poikstdjk) · BleepingComputer · 0 upvotes · 0 comments

---

Tags: [#tech-news](https://daily.dev/tags/tech-news), [#ransomware](https://daily.dev/tags/ransomware), [#powershell](https://daily.dev/tags/powershell)

[View this post on daily.dev](https://daily.dev/posts/confluence-to-cerber-exploitation-of-cve-2023-22518-6bdcbmhg5)