9/3/25, 6:08 PM

Cerber ransomware’s Linux variant is active in exploiting CVE-2023-22518 in Confluence servers, as reported in a Darktrace blog published on 17 April 2024. It comprises three highly obfuscated C++ payloads packed with UPX, deployed as a 64-bit ELF, functioning as a primary stager, a log checker for environment assessment, and an encryptor that renames files with a .L0CK3D extension.

Initial access is gained by leveraging the Confluence vulnerability to create an administrator account, after which a web shell is used to download and run the primary Cerber payload. The primary payload then downloads a secondary log-check payload, followed by an encryptor payload that overwrites files and attempts to encrypt directories such as /usr and /var, leaving a ransom note.

The C2 contact for the primary payload is listed as 45.145.6[.]112 (now defunct), and the encryptor operates by rewriting files to the .L0CK3D extension on Linux. This analysis highlights Cerber’s enduring, modular approach and its targeting of Linux systems alongside more widely covered Windows activity, according to Darktrace.