Lazarus Group Targets Log4Shell Flaw Via Telegram Bots
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services |
Full article336 words · extracted from infosecurity-magazine.com · click to collapse
The threat actor known as Lazarus Group has been observed targeting the Log4Shell vulnerability (CVE-2021-44228) in a new series of attacks dubbed “Operation Blacksmith.”
According to a new advisory published by Cisco Talos security researchers earlier today, the attacks leveraged the Log4Shell flaw in publicly facing VMWare Horizon servers for initial access.
“This campaign consists of continued opportunistic targeting of enterprises around the world that publicly host and expose their vulnerable infrastructure to n-day vulnerability exploitation such as CVE-2021-44228,” reads the advisory.
“We have observed Lazarus target companies in the manufacturing, agricultural and physical security sectors.”
Lazarus Group's Shifting Tactics and Exploitation Techniques
Upon successful exploitation, Lazarus conducted extensive reconnaissance, employing various commands to gather system information, query event logs and conduct OS credential dumping.
The attackers deployed a custom-made implant named HazyLoad, acting as a proxy tool to establish direct access to the compromised system.
Notably, Lazarus deviated from previous patterns by creating a local user account with administrative privileges instead of using unauthorized domain-level accounts.
In a significant development, the threat actors also shifted their tactics in the hands-on-keyboard phase by downloading and using credential dumping utilities, including ProcDump and MimiKatz.
The second phase of the operation revealed the deployment of a previously unknown Remote Access Trojan (RAT) dubbed “NineRAT.” Noteworthy is the RAT’s utilization of the Telegram-based C2 channel to receive preliminary commands for fingerprinting infected systems.
Additionally, the research identified a shift in Lazarus’ tactics, as NineRAT is written in DLang, indicating a departure from traditional frameworks.
“NineRAT also has the capability to uninstall itself from the system using a BAT file,” the company added.
Cisco Talos also suggested that the data collected by Lazarus via NineRAT may be shared with other Advanced Persistent Threat (APT) groups, residing in a separate repository from initial access and implant deployment data.
Full details of the IOCs for this research can also be found in the firm’s Github repository.
Read more on Log4j vulnerabilities: Two-Fifths of Log4j Apps Use Vulnerable Versions
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/lazarus-group-log4shell-flaw/