"Attacker Exploits Victim Resources for Gains on Titan Network"

Trend Micro researchers documented an attack that exploited Atlassian Confluence vulnerability CVE-2023-22527 to gain remote code execution and install Titan Network components for cryptomining. The intruder performed system reconnaissance, downloaded multiple shell scripts and Titan binaries from a malicious server, and bound compromised hosts to the attacker’s Titan identity to collect rewards. #CVE-2023-22527 #TitanNetwork

Keypoints

Attackers exploited an unauthenticated Confluence template injection (CVE-2023-22527) to achieve remote code execution (RCE).
Remote commands (ls, pwd, cat /etc/os-release, uname -a, df -h, free -g) were used for system and resource discovery.
Multiple shell scripts were downloaded from 3[.]39[.]22[.]13 to /tmp and executed to install Titan binaries (titan-edge, libgoworkerd.so).
Compromised machines were registered to the Titan Network/Cassini Testnet using an attacker identity to earn rewards.
The adversary installed an aleo-pool client and connected to aleo[.]zkrush[.]com for additional cryptomining activity.
SSH public keys and a modified SSH config were deployed to enable lateral movement in AWS, and a reverse shell variant contacted 13[.]236[.]179[.]8.

MITRE Techniques

[T1190] Exploit Public-Facing Application – The attacker exploited Atlassian Confluence to gain RCE. [‘exploited the Atlassian Confluence vulnerability CVE-2023-22527’]
[T1082] System Information Discovery – The adversary collected OS and system details to profile hosts. [‘cat /etc/os-release’]
[T1083] File and Directory Discovery – The actor listed directories and files to locate writable locations and artifacts. [‘ls /tmp’]
[T1057] Process Discovery – The attacker checked running processes and cgroup info to determine containerization and privilege context. [‘checking the control group (cgroup) information for the process with PID 1’]
[T1059.004] Command and Scripting Interpreter: Unix Shell – Multiple shell scripts were downloaded and executed to deploy payloads. [‘downloaded and executed multiple shell scripts to install Titan binaries’]
[T1574.006] Hijack Execution Flow: Dynamic Linker Hijacking – Environment variables were manipulated to influence execution of Titan binaries. [‘overwrites the “LD_LIBRARY_PATH” environment variable’]
[T1098.004] Account Manipulation: SSH Authorized Keys – Public SSH keys were deployed to /root/.ssh/authorized_keys to enable unauthorized access. [‘deploys the SSH public key in the RSA format in the root user directory “/root/.ssh/authorized_keys”‘]
[T1105] Ingress Tool Transfer – Binaries and scripts were retrieved from a remote host (3[.]39[.]22[.]13) onto victims. [‘downloads the file “titan.tar.gz” from same server’]
[T1071.001] Application Layer Protocol: Web Protocols – The attacker used web protocols to communicate with Titan and mining pools. [‘connects to the aleo[.]zkrush[.]com pool server’]

Indicators of Compromise

[IP addresses] Malicious servers and C2 – 3[.]39[.]22[.]13 (script & binary hosting), 13[.]236[.]179[.]8 (reverse shell/C2), and 1 more IP (35[.]74[.]215[.]126).
[Domains/URLs] Payload and pool endpoints – http://3[.]39[.]22[.]13/0 (script hosting), wss[:]//aleo[.]zkrush[.]com:3333 (mining pool connection).
[File names] Downloaded binaries and scripts – titan.tar.gz, titan-edge, libgoworkerd.so, and script files saved as a0–a7 in /tmp.
[SSH artifacts] Lateral movement artifacts – an RSA public key installed to /root/.ssh/authorized_keys and a modified SSH config with AuthorizedKeysCommand directives.
[Attacker identity] Titan node binding – GUID used to bind devices: 08DA69AE-6E7C-43F2-A8D0-D97D7FF517A1.

Trend Micro researchers observed a campaign in which attackers abused an unauthenticated template injection in Atlassian Confluence (CVE-2023-22527) to execute commands on vulnerable servers and turn them into Titan Network nodes for profit. The adversary started by issuing simple reconnaissance commands—such as ls and pwd—via the exploited Confluence endpoint and returned command outputs in a response header labelled “Cmd”, allowing remote enumeration of directories and context. Public IP lookup services (IPinfo and IP-API) were queried to identify external addresses, and further queries like cat /etc/os-release, uname -a, df -h, and free -g collected OS and resource information; the attackers also inspected cgroup data for PID 1 to determine whether the service was running inside a container, which could inform privilege escalation attempts.

After profiling each host, the intruder downloaded a series of shell scripts from a remote server at 3[.]39[.]22[.]13 into /tmp, naming them 0 through 9 and saving local copies as a0, a1, a2, etc., deliberately omitting file extensions to avoid simple detections. The initial script retrieved titan.tar.gz and extracted ELF components including titan-edge and libgoworkerd.so into /tmp. Subsequent scripts adjusted environment variables (one attempts to overwrite LD_LIBRARY_PATH, misspelled as LD_LIZBRARY_PATH), started the titan-edge daemon, and configured it to join the Titan Cassini Testnet. During this process the attacker bound the node to their attacker identity (08DA69AE-6E7C-43F2-A8D0-D97D7FF517A1) and recorded node information to info.log; another script provided a stop mechanism for the titan-edge service.

To ensure persistence and reliability of the deployment, the adversary included fallback and support scripts: a5 fetched the official Titan binaries from the project’s GitHub release if initial extraction failed, while a6 and a7 installed and launched an aleo-pool client to connect to the zkRush mining pool and the Aleo TestNet Beta for additional mining revenue. The attacker also prepared lateral-movement tools targeting cloud environments—deploying an RSA public key into /root/.ssh/authorized_keys and staging a modified SSH configuration with AuthorizedKeysCommand and AuthorizedKeysCommandUser directives used by AWS Instance Connect. One script variant implemented a bash reverse shell to a C2 server at 13[.]236[.]179[.]8 over TCP port 80, indicating the capability for remote control beyond the mining operations.

The combined sequence—vulnerability exploitation, host profiling, tool transfer, service execution, and persistence—allowed the operator to divert victim compute and storage resources into the Titan resource network and to run cryptomining workloads against external pools. This activity highlights the dual risk of supply-side resource monetization and cloud lateral movement when internet-facing management systems remain unpatched. Organizations can reduce exposure by applying available Confluence patches promptly, implementing network and file monitoring to detect unusual outbound connections or the creation of unexpected binaries in temporary directories, restricting execution privileges for web application processes, and enforcing strong SSH key and instance metadata protections. Additional protective layers such as behavior-based detection and endpoint response solutions can help detect and block the scripts and tools used in this campaign before they fully deploy.

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print

“Attacker Exploits Victim Resources for Gains on Titan Network”