ELPACO-team ransomware exploits unpatched Confluence CVE-2023-22527
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Threat actors exploited Confluence template injection to deploy ELPACO-team ransomware 62 hours post-compromise, establishing persistence via AnyDesk.
In June 2024, an unpatched Atlassian Confluence server was compromised via CVE-2023-22527, a template injection vulnerability enabling remote code execution. Initial access came from IP 45.227.254.124 running whoami, followed by a second actor from 91.191.209.46 delivering a Metasploit Meterpreter payload to establish command and control. The threat actor executed a consistent playbook: installing AnyDesk for persistent remote access, creating a local administrator account ("noname"), enabling RDP, and disabling Windows Defender. Credential harvesting via Mimikatz and Impacket Secretsdump yielded domain administrator credentials. The actor performed lateral movement using RDP and Impacket wmiexec, then deployed ELPACO-team.exe (a Mimic ransomware variant) across backup and file servers approximately 62 hours after initial compromise. While some data transfer occurred via AnyDesk, no significant exfiltration was observed before ransomware execution. Failed attempts to exploit Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) were also documented.
Mentioned in this report
Detection guidance
Impacket wmiexec Style Command Execution via WmiPrvSE
cmd.exe spawned by WmiPrvSE.exe with the Impacket wmiexec pattern of /Q /c, output redirected to an ADMIN$ share file, and 2>&1. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Impacket wmiexec Style Command Execution via WmiPrvSE
description: Detects cmd.exe spawned by WmiPrvSE.exe using the Impacket wmiexec semi-interactive
shell pattern (/Q /c, output written to a file on the local ADMIN$ share via 127.0.0.1,
2>&1 redirection). Used for lateral movement before ransomware deployment.
tags:
- attack.execution
- attack.lateral-movement
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \WmiPrvSE.exe
Image|endswith: \cmd.exe
CommandLine|contains|all:
- /Q
- /c
- 127.0.0.1\ADMIN$\__
- 2>&1
condition: selection
falsepositives:
- Custom admin scripts that deliberately mimic the wmiexec output redirection format
level: high
id: 6dccee82-b5d2-5457-840c-c601cbddda9c
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
Windows Defender Disabled via PowerShell or Registry Command Line
Command-line disabling of Defender real-time protection through Set-MpPreference or reg.exe edits to Defender policy values. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Defender Disabled via PowerShell or Registry Command Line
description: Detects command lines that disable Windows Defender real-time monitoring
or anti-spyware through Set-MpPreference or reg.exe, as performed by the threat
actor before credential dumping and ransomware deployment.
tags:
- attack.defense-impairment
- attack.t1685
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection_ps:
CommandLine|contains|all:
- Set-MpPreference
- -DisableRealtimeMonitoring
selection_reg:
Image|endswith: \reg.exe
CommandLine|contains|all:
- Windows Defender
- add
selection_reg_value:
CommandLine|contains:
- DisableAntiSpyware
- DisableRealtimeMonitoring
condition: selection_ps or (selection_reg and selection_reg_value)
falsepositives:
- Administrators temporarily disabling Defender during software installation or troubleshooting
- Deployment of a third-party AV product that scripts Defender exclusion
level: high
id: a82f04d0-dbf5-5d0b-b947-ed18b3ad2377
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
RDP Enabled via reg.exe fDenyTSConnections Modification
reg.exe setting fDenyTSConnections to 0 to enable Remote Desktop, as done by the actor ahead of RDP lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDP Enabled via reg.exe fDenyTSConnections Modification
description: Detects reg.exe setting the fDenyTSConnections value to 0 to enable Remote
Desktop on a host, seen in the actor playbook before RDP lateral movement.
tags:
- attack.defense-impairment
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \reg.exe
CommandLine|contains|all:
- add
- fDenyTSConnections
- /d 0
condition: selection
falsepositives:
- Administrators enabling RDP on new servers via scripts
- Golden image or provisioning scripts that enable Remote Desktop
level: medium
id: 3849b00b-6727-5007-8758-6ed3bac9a708
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs