# ELPACO-team ransomware exploits unpatched Confluence CVE-2023-22527

Published: 2025-05-19 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/84e3e99b-ac40-5470-a639-5ccb6d8128a9/elpaco-team-ransomware-exploits-unpatched-confluence-cve-2023-22527

> Threat actors exploited Confluence template injection to deploy ELPACO-team ransomware 62 hours post-compromise, establishing persistence via AnyDesk.

In June 2024, an unpatched Atlassian Confluence server was compromised via CVE-2023-22527, a template injection vulnerability enabling remote code execution. Initial access came from IP 45.227.254.124 running whoami, followed by a second actor from 91.191.209.46 delivering a Metasploit Meterpreter payload to establish command and control. The threat actor executed a consistent playbook: installing AnyDesk for persistent remote access, creating a local administrator account ("noname"), enabling RDP, and disabling Windows Defender. Credential harvesting via Mimikatz and Impacket Secretsdump yielded domain administrator credentials. The actor performed lateral movement using RDP and Impacket wmiexec, then deployed ELPACO-team.exe (a Mimic ransomware variant) across backup and file servers approximately 62 hours after initial compromise. While some data transfer occurred via AnyDesk, no significant exfiltration was observed before ransomware execution. Failed attempts to exploit Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) were also documented.

## Mentioned in this report

- Vulnerabilities: CVE-2020-1472 (KEV), CVE-2021-34527 (KEV), CVE-2023-22527 (KEV)
- Threat actors: ELPACO-team

## Detection guidance (public sample)

### Impacket wmiexec Style Command Execution via WmiPrvSE

ATT&CK: T1059.003

cmd.exe spawned by WmiPrvSE.exe with the Impacket wmiexec pattern of /Q /c, output redirected to an ADMIN$ share file, and 2>&1. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Impacket wmiexec Style Command Execution via WmiPrvSE
description: Detects cmd.exe spawned by WmiPrvSE.exe using the Impacket wmiexec semi-interactive
  shell pattern (/Q /c, output written to a file on the local ADMIN$ share via 127.0.0.1,
  2>&1 redirection). Used for lateral movement before ransomware deployment.
tags:
- attack.execution
- attack.lateral-movement
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WmiPrvSE.exe
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
    - /Q
    - /c
    - 127.0.0.1\ADMIN$\__
    - 2>&1
  condition: selection
falsepositives:
- Custom admin scripts that deliberately mimic the wmiexec output redirection format
level: high
id: 6dccee82-b5d2-5457-840c-c601cbddda9c
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
```

### Windows Defender Disabled via PowerShell or Registry Command Line

ATT&CK: T1685

Command-line disabling of Defender real-time protection through Set-MpPreference or reg.exe edits to Defender policy values. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Defender Disabled via PowerShell or Registry Command Line
description: Detects command lines that disable Windows Defender real-time monitoring
  or anti-spyware through Set-MpPreference or reg.exe, as performed by the threat
  actor before credential dumping and ransomware deployment.
tags:
- attack.defense-impairment
- attack.t1685
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    CommandLine|contains|all:
    - Set-MpPreference
    - -DisableRealtimeMonitoring
  selection_reg:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
    - Windows Defender
    - add
  selection_reg_value:
    CommandLine|contains:
    - DisableAntiSpyware
    - DisableRealtimeMonitoring
  condition: selection_ps or (selection_reg and selection_reg_value)
falsepositives:
- Administrators temporarily disabling Defender during software installation or troubleshooting
- Deployment of a third-party AV product that scripts Defender exclusion
level: high
id: a82f04d0-dbf5-5d0b-b947-ed18b3ad2377
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
```

### RDP Enabled via reg.exe fDenyTSConnections Modification

ATT&CK: T1112

reg.exe setting fDenyTSConnections to 0 to enable Remote Desktop, as done by the actor ahead of RDP lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RDP Enabled via reg.exe fDenyTSConnections Modification
description: Detects reg.exe setting the fDenyTSConnections value to 0 to enable Remote
  Desktop on a host, seen in the actor playbook before RDP lateral movement.
tags:
- attack.defense-impairment
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
    - add
    - fDenyTSConnections
    - /d 0
  condition: selection
falsepositives:
- Administrators enabling RDP on new servers via scripts
- Golden image or provisioning scripts that enable Remote Desktop
level: medium
id: 3849b00b-6727-5007-8758-6ed3bac9a708
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/84e3e99b-ac40-5470-a639-5ccb6d8128a9/elpaco-team-ransomware-exploits-unpatched-confluence-cve-2023-22527.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup