Log4Shell was in the wild at least nine days before public disclosure

Threat actors are already abusing Log4Shell vulnerability in the Log4j library for malicious purposes such as deploying malware.

A few hours ago, researchers at NetLab 360 reported that their Anglerfish and Apacket honeypots were already hit by attacks attempting to trigger the Log4Shell flaw in the Log4j library. The attempts were carried out by Muhstik and Mirai botnets in attacks aimed at Linux devices.

Other research teams observed threat actors attempting to exploit the vulnerability, the Microsoft Threat Intelligence Center confirmed that attackers are using it to drop Cobalt Strike beacons and coin miners.

“At the time of publication, the vast majority of observed activity has been scanning, but exploitation and post-exploitation activities have also been observed. Based on the nature of the vulnerability, once the attacker has full access and control of an application, they can perform a myriad of objectives. Microsoft has observed activities including installing coin miners, Cobalt Strike to enable credential theft and lateral movement, and exfiltrating data from compromised systems.” reads the analysis published by Microsoft.

The situation is worse than initially thought because the vulnerability has been under attack for at least more than a week prior to its public disclosure on December 10. Below is the tweet published by Cloudflare CEO Matthew Prince.

Cisco Talos researchers first spotted activities related to the log4Shell vulnerability on December 2.

“Cisco Talos has observed attacker activity related to CVE-2021-22448 beginning 02-December-2021. It is recommended that organizations expand their hunt for scanning and exploit activity to this date.” reads the advisory published by Cisco Talos. “Attackers may also leverage this vulnerability as a means of information disclosure to exfiltrate credentials (and other configurations) stored in files and environment variables from a vulnerable host. For example, the AWS CLI uses environment variables and configuration files that can be exfiltrated by exploiting CVE-2021-22448. Please see the Information Leaks section for more information.”

Talos researchers also updated the list of IOCs to include information about mining activity carried out by exploiting the CVE-2021-44228 flaw. The researchers spotted mining activity aimed at delivering of the Kinsing crypto-miner.

Auvik, Huntress Lab, and N-able also confirmed their services have been impacted before Decembre10. Huntress lab researchers have created a tool to help organizations to test whether their applications are vulnerable to CVE-2021-44228. 

If you are interested in more details about the issue, let me suggest reading this analysis from the Swiss CERT.

https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Log4Shell)

[adrotate banner=”5″]

[adrotate banner=”13″]