Apache Log4j Vulnerability — Log4Shell — Widely Under Active Attack

Threat actors are actively weaponizing unpatched servers
affected by the newly disclosed “Log4Shell^[1]” vulnerability in Log4j
to install cryptocurrency miners, Cobalt Strike, and recruit the
devices into a botnet, even as telemetry signs point to
exploitation of the flaw nine days before it even came to
light.

Netlab, the networking security division of Chinese tech giant
Qihoo 360, disclosed^[2]
threats such as Mirai^[3]
and Muhstik^[4]
(aka Tsunami) are setting their sights on vulnerable systems to
spread the infection and grow its computing power to orchestrate
distributed denial-of-service (DDoS) attacks with the goal of
overwhelming a target and rendering it unusable. Muhstik was
previously spotted exploiting a critical security flaw in Atlassian
Confluence (CVE-2021-26084^[5], CVSS score: 9.8)
earlier this September.

The latest development comes as it has emerged that the
vulnerability has been under attack for at least more than a week
prior to its public disclosure on December 10, and companies like
Auvik^[6], ConnectWise Manage^[7], and N-able^[8]
have confirmed their services are impacted, widening the scope of
the flaw’s reach to more manufacturers.

“Earliest evidence we’ve found so far of [the] Log4j exploit is
2021-12-01 04:36:50 UTC,” Cloudflare CEO Matthew Prince tweeted^[9]
Sunday. “That suggests it was in the wild at least nine days before
publicly disclosed. However, don’t see evidence of mass
exploitation until after public disclosure.” Cisco Talos, in an
independent report^[10], said it observed
attacker activity related to the flaw beginning December 2.

Tracked CVE-2021-22448^[11] (CVSS score: 10.0), the
flaw concerns a case of remote code execution in Log4j, a
Java-based open-source Apache logging framework broadly used in
enterprise environments applications to record events and messages
generated by software applications.

All that is required of an adversary to leverage the
vulnerability is send a specially crafted string containing the
malicious code that gets logged by Log4j version 2.0 or higher,
effectively enabling the threat actor to load arbitrary code from
an attacker-controlled domain on a susceptible server and take over
control.

“The bulk of attacks that Microsoft has observed at this time
have been related to mass scanning by attackers attempting to
thumbprint vulnerable systems, as well as scanning by security
companies and researchers,” Microsoft 365 Defender Threat
Intelligence Team said^[12] in an analysis. “Based
on the nature of the vulnerability, once the attacker has full
access and control of an application, they can perform a myriad of
objectives.”

In particular, the Redmond-based tech giant said it detected a
wealth of malicious activities, including installing Cobalt Strike
to enable credential theft and lateral movement, deploying coin
miners, and exfiltrating data from the compromised machines.

If anything, incidents like these illustrate how a single flaw,
when uncovered in packages incorporated in a lot of software, can
have ripple effects, acting as a channel for further attacks and
posing a critical risk to affected systems. “All threat actors need
to trigger an attack is one line of text,” Huntress Labs Senior
Security Researcher John Hammond said^[13]. “There’s no obvious
target for this vulnerability — hackers are taking a spray-and-pray
approach to wreak havoc.”