DHS issues emergency directive ordering all federal civilian agencies to address Log4j flaw

The directive lands amid escalating concern about the impact of the bug.

U.S. cyber officials issued an emergency directive Friday giving all federal civilian agencies until Dec. 23 to assess their internet-facing networks for the Apache Log4j vulnerability and immediately patch the systems, or take other measures to mitigate the software flaw.

The directive, issued by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, comes in response to “the active exploitation by multiple threat actors” of the Log4j bug, which has roiled the information security community since it emerged Dec. 10 as a vulnerability in widely used logging software. The directive also requires agencies to report to CISA by Dec. 28 all software applications affected by the bug by name and version, and what actions were taken.

“The log4j vulnerabilities pose an unacceptable risk to federal network security,” CISA Director Jen Easterly said in a statement. “If you are using a vulnerable product on your network, you should consider your door wide open to any number of threats.”

The directive is based on current exploitation of the Log4j vulnerabilities, the likelihood of exploitation, the prevalence of affected software among federal agencies, and the potential impact of a successful compromise, Easterly’s statement said.

The directive, first reported by CNN, comes amid escalating concern about how hackers would leverage the vulnerability to launch ransomware attacks or take remote control of affected systems. In comments first reported by CyberScoop, Easterly said Dec. 14 that the bug was perhaps “the most serious” she’d seen in her career, and expected it to be “widely exploited.” Another top CISA official, Jay Gazlay, estimated that hundreds of millions of devices” were likely to be affected.

The same day, threat intelligence analysts at Microsoft and cybersecurity firm Mandiant said they’d seen indications that nation-state hackers associated with the governments of China, Iran, North Korea and Turkey had begun to experiment with and leverage the bug in hacking campaigns.

On Friday, cybersecurity firm AdvIntel posted an analysis stating that hackers working with the Conti ransomware group, one of the most prolific and concerning ransomware operations, started to use the vulnerability in active ransomware attacks on Dec. 15.

Open-source security is posing challenges governments can’t easily solve

A diffuse landscape, fruitful targets, companies not stepping up, AI’s influence and flagging U.S. government efforts all figure into a shifting threat.

CISA emergency directive tells agencies to fix credentials after Microsoft breach

Cyber Safety Review Board needs stronger authorities, more independence, experts say

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure