Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Fewer-Than-Expected Log4j Attacks, but Mirai Joins the Fray

Log4Shell, the critical unauthenticated remote code execution vulnerability identified in early December 2021 in the Apache Log4j logging utility, hasn’t seen the mass exploitation that many expected, but an exploit for it is now part of the Mirai botnet’s arsenal, researchers warn.

Log4Shell, the critical unauthenticated remote code execution vulnerability identified in early December 2021 in the Apache Log4j logging utility, hasn’t seen the mass exploitation that many expected, but an exploit for it is now part of the Mirai botnet’s arsenal, researchers warn.

Both cybercriminals and nation-state threat actors have been observed exploiting the security bug – which is tracked as CVE-2021-44228 – in their attacks, including in assaults targeting industrial organizations.

Despite that, no mass exploitation of the vulnerability has been observed to date, most likely because the industry jumped into action and took the necessary steps to address or mitigate Log4Shell and the remaining security issues identified in Log4j over the past two months.

“As soon as details of the Log4Shell bug became clear, the world’s biggest and most important cloud services, software packages and enterprises took action to steer away from the iceberg, supported by shared threat intelligence and practical guidance from the security community,” Sophos notes.

[ READ: Log4Shell Tools and Resources for Defenders – Continuously Updated ]

Sophos says it saw a peak of Log4Shell scans between Dec. 20 and Dec. 23, 2021 – its applications were hit more than 600,000 per day –, followed by a drop over the next week. The attacks flattened in January 2022, at around 100,000 daily hits on Sophos’ firewalls.

Log4Shell exploitation is different depending on the application that implements Log4j, meaning that threat actors likely performed a large number of redundant scans while attempting to figure out how to exploit each application, Sophos notes.

“This doesn’t mean the threat level declined too: by this time, an ever-greater percentage of detections were likely real attacks, with fewer coming from researchers monitoring the latest patching status,” Sophos says.

Advertisement. Scroll to continue reading.

With more threat actors adding exploits to their arsenals, exploitation of the Log4j vulnerabilities is expected to continue.

Recently, even malware spreading the Mirai botnet – well known for being used to launch massive distributed denial of service (DDoS) attacks – was observed packing code designed to exploit Log4Shell (CVE-2021-44228), Akamai says.

However, the exploit appears designed to specifically target devices from Zyxel, which has already confirmed impact from the vulnerability.

One of the observed samples was designed to scan for a large number of devices vulnerable to remote code execution, while a second one dropped these functions in favor of Log4j exploitation. The standard Mirai attack functions were still present in it.

Related: CISA Unaware of Any Significant Log4j Breaches in U.S.

Related: Ukraine Attacks Involved Exploitation of Log4j, October CMS Vulnerabilities

Related: Five Eyes Nations Issue Joint Guidance on Log4j Vulnerabilities

Related: Mirai-Based ‘Manga’ Botnet Targets Recent TP-Link Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...