• Latest
  • Trending
Log4shell exploits now used mostly for DDoS botnets, cryptominers

Log4shell exploits now used mostly for DDoS botnets, cryptominers

March 3, 2022
Inaugural AfCFTA Conference on Women and Youth in Trade

Inaugural AfCFTA Conference on Women and Youth in Trade

September 6, 2022
Instagram fined €405m over children’s data privacy

Instagram fined €405m over children’s data privacy

September 6, 2022
8 Most Common Causes of a Data Breach

5.7bn data entries found exposed on Chinese VPN

August 18, 2022
Fibre optic interconnection linking Cameroon and Congo now operational

Fibre optic interconnection linking Cameroon and Congo now operational

July 15, 2022
Ericsson and MTN Rwandacell Discuss their Long-Term Partnership

Ericsson and MTN Rwandacell Discuss their Long-Term Partnership

July 15, 2022
Airtel Africa Purchases $42M Worth of Additional Spectrum

Airtel Africa Purchases $42M Worth of Additional Spectrum

July 15, 2022
Huawei steps up drive for Kenyan talent

Huawei steps up drive for Kenyan talent

July 15, 2022
TSMC predicts Q3 revenue boost thanks to increased iPhone 13 demand

TSMC predicts Q3 revenue boost thanks to increased iPhone 13 demand

July 15, 2022
Facebook to allow up to five profiles tied to one account

Facebook to allow up to five profiles tied to one account

July 15, 2022
Top 10 apps built and managed in Ghana

Top 10 apps built and managed in Ghana

July 15, 2022
MTN Group to Host the 2nd Edition of the MoMo API Hackathon

MTN Group to Host the 2nd Edition of the MoMo API Hackathon

July 15, 2022
KIOXIA Introduce JEDEC XFM Removable Storage with PCIe/NVMe Spec

KIOXIA Introduce JEDEC XFM Removable Storage with PCIe/NVMe Spec

July 15, 2022
  • Consumer Watch
  • Kids Page
  • Directory
  • Events
  • Reviews
Sunday, 5 February, 2023
  • Login
itechnewsonline.com
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion
Subscription
Advertise
No Result
View All Result
itechnewsonline.com
No Result
View All Result

Log4shell exploits now used mostly for DDoS botnets, cryptominers

by ITECHNEWS
March 3, 2022
in Infosec, Leading Stories
0 0
0
Log4shell exploits now used mostly for DDoS botnets, cryptominers

The Log4Shell vulnerabilities in the widely used Log4j software are still leveraged by threat actors today to deploy various malware payloads, including recruiting devices into DDoS botnets and for planting cryptominers.

According to a report by Barracuda, the past couple of months were characterized by dips and spikes in the targeting of Log4Shell, but the volume of exploitation attempts has remained relatively constant.

YOU MAY ALSO LIKE

Inaugural AfCFTA Conference on Women and Youth in Trade

Instagram fined €405m over children’s data privacy

After analyzing these attacks, Barracuda determined that most exploitation attempts came from US-based IP addresses, followed by Japan, central Europe, and Russia.

Attacker IPs heatmap
Attacker IPs heatmap (Barracuda)

In December 2021, researchers found Log4j version 2.14.1 and all previous versions to be vulnerable to CVE-2021-44228, dubbed “Log4Shell,” a critical zero-day remote code execution flaw.

Apache, the developer of Log4j, attempted to resolve the issue by releasing version 2.15.0. However, subsequent vulnerability discoveries and security gaps extended the patching race until the end of the year, when version 2.17.1 finally addressed all problems.

However, according to Barracuda, many systems continue to run older versions of the popular logging framework and are thus vulnerable to exploitation.

Leveraged for DDoS and mining

Barracuda researchers have spotted various payloads targeting vulnerable Jog4j deployments, but the Mirai botnet derivatives appear to take the lion’s share at this moment.

The Mirai malware targets publicly exposed network cameras, routers, and other devices and enlists them into a botnet of remotely controlled bots. The threat actor can then control this botnet to perform DDoS attacks against a specific target, depleting their resources and disrupting their online service.

As Barracuda’s report explains, Mirai is distributed in various forms and from different sources, indicating that the operators are attempting to build a large botnet that targets victims of all sizes in the future.

The threat actors behind these operations are either renting their botnet firepower to others or are launching DDoS attacks themselves to extort companies.

Other payloads seen dropped by recent Log4j exploitation include:

  • BillGates malware (DDoS)
  • Kinsing (cryptominer)
  • XMRig (cryptominer)
  • Muhstik (DDoS)
Script to set up the miner
Script to set up the miner (Barracuda)

Barracuda’s analysts say they did not see ransomware gangs exploiting publicly exposed VMWare installations and believe it’s being used more as an insider threat for already compromised networks.

A permanent threat

The simplest way to protect against these types of attacks is to update Log4j to version 2.17.1 or later and keep all your web applications up to date in general.

As most of the devices targeted by Mirai do not allow you to update individual packages, you will need to check for updated firmware that contains Log4j fixes and apply them if available.

While Barracuda reports seeing a steady volume of Log4Shell attacks, Sophos has recently reported a decline. However, all analysts agree that the threat remains.

Volume of attacks targeting Log4j
Volume of attacks targeting Log4j (Barracuda)

Even if the interest of the majority of threat actors fades, some will continue to target vulnerable Log4j deployments since their numbers remain notable.

Valuable organizations that were lucrative for ransomware attacks have applied the security updates, but for purposes of cryptomining and DDoS attacks, neglected systems that run older versions are excellent targets.

Source: Bill Toulas
Via: bleepingcomputer
Tags: cryptominersLog4shell exploits now used DDoS botnets
ShareTweetShare
Plugin Install : Subscribe Push Notification need OneSignal plugin to be installed.

Search

No Result
View All Result

Recent News

Inaugural AfCFTA Conference on Women and Youth in Trade

Inaugural AfCFTA Conference on Women and Youth in Trade

September 6, 2022
Instagram fined €405m over children’s data privacy

Instagram fined €405m over children’s data privacy

September 6, 2022
8 Most Common Causes of a Data Breach

5.7bn data entries found exposed on Chinese VPN

August 18, 2022

About What We Do

itechnewsonline.com

We bring you the best Premium Tech News.

Recent News With Image

Inaugural AfCFTA Conference on Women and Youth in Trade

Inaugural AfCFTA Conference on Women and Youth in Trade

September 6, 2022
Instagram fined €405m over children’s data privacy

Instagram fined €405m over children’s data privacy

September 6, 2022

Recent News

  • Inaugural AfCFTA Conference on Women and Youth in Trade September 6, 2022
  • Instagram fined €405m over children’s data privacy September 6, 2022
  • 5.7bn data entries found exposed on Chinese VPN August 18, 2022
  • Fibre optic interconnection linking Cameroon and Congo now operational July 15, 2022
  • Home
  • InfoSec
  • Opinion
  • Africa Tech
  • Data Storage

© 2021-2022 iTechNewsOnline.Com - Powered by BackUPDataSystems

No Result
View All Result
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion

© 2021-2022 iTechNewsOnline.Com - Powered by BackUPDataSystems

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In
Go to mobile version