Log4j is a Java logging library whose vulnerabilities, including Log4Shell, can let attackers execute code through dependent applications.
Search across headline titles and summaries.
Background for this topic.
Apache Log4j is a Java library that records application events, such as errors and user activity, to files, consoles, or other destinations. Log4j 2 is distinct from the older Log4j 1.x branch, and both may appear directly or as transitive dependencies inside larger applications and products.
Security attention centers on Log4Shell (CVE-2021-44228), a flaw in Log4j 2’s JNDI lookup processing. When an application logged attacker-controlled text, a vulnerable configuration could contact an attacker-controlled service and potentially execute code. Effective defense requires identifying bundled and indirect Log4j copies, upgrading to a supported fixed release, and treating exposed applications as potential attack surfaces. Monitoring application and network logs for exploit attempts, followed by focused compromise assessment where vulnerable systems were reachable, remains important because patching alone does not establish whether exploitation occurred.
Weekly headline count for the current query.
A China-linked threat actor has been attributed to a cyber attack targeting an U.S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.S. entities that are linked to or involved in policy issues
The notorious North Korea-linked threat actor known as the Lazarus Group has been attributed to a new global campaign that involves the opportunistic exploitation of security flaws in Log4j to deploy previously undocumented remote access trojans (RATs) on compromised hosts
The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year
Iranian state-sponsored actors are leaving no stone unturned to exploit unpatched systems running Log4j to target Israeli entities, indicating the vulnerability’s long tail for remediation
The North Korea-backed Lazarus Group has been observed leveraging the Log4Shell vulnerability in VMware Horizon servers to deploy the NukeSped (aka Manuscrypt) implant against targets located in its southern counterpart
The "hotpatch" released by Amazon Web Services (AWS) in response to the Log4Shell vulnerabilities could be leveraged for container escape and privilege escalation, allowing an attacker to seize control of the underlying host
A previously undocumented backdoor has been observed targeting Linux systems with the goal of corralling the machines into a botnet and acting as a conduit for downloading and installing rootkits
A "potentially destructive actor" aligned with the government of Iran is actively exploiting the well-known Log4j vulnerability to infect unpatched VMware Horizon servers with ransomware
Most security practitioners are now aware of the Log4Shell vulnerability discovered toward the end of 2021. No one knows how long the vulnerability existed before it was discovered. The past couple of months have had security teams scrambling to patch the Log4Shell vulnerability found in Apache Log4j, a Java library widely used to log error messages in applications. Beyond patching, it's helpful