Select Page

Threat actors are actively weaponizing unpatched servers affected by the newly identified “Log4Shell” vulnerability in Log4j to install cryptocurrency miners, Cobalt Strike, and recruit the devices into a botnet, even as telemetry signs point to exploitation of the flaw nine days before it even came to light.

Netlab, the networking security division of Chinese tech giant Qihoo 360, disclosed threats such as Mirai and Muhstik (aka Tsunami) are setting their sights on vulnerable systems to spread the infection and grow its computing power to orchestrate distributed denial-of-service (DDoS) attacks with the goal of overwhelming a target and rendering it unusable. Muhstik was previously spotted exploiting a critical security flaw in Atlassian Confluence (CVE-2021-26084, CVSS score: 9.8) earlier this September.

The latest development comes as it has emerged that the vulnerability has been under attack for at least more than a week prior to its public disclosure on December 10, and companies like AuvikConnectWise Manage, and N-able have confirmed their services are impacted, widening the scope of the flaw’s reach to more manufacturers.

“Earliest evidence we’ve found so far of [the] Log4j exploit is 2021-12-01 04:36:50 UTC,” Cloudflare CEO Matthew Prince tweeted Sunday. “That suggests it was in the wild at least nine days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.” Cisco Talos, in an independent report, said it observed attacker activity related to the flaw beginning December 2.

images from Hacker News