Malwarecritical

Lazarus Group Using Log4j Exploits to Deploy Remote Access Trojans

The Hacker Newsby @TheHackersNewsDec 12, 2023 · 04:59 UTC (Dec 12, 2023)3 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-44228 CVE-2021-44832 CVE-2023-42793

Tags: cve-2021-44228 cve-2021-44832 cve-2023-42793 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-44228	JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)	10.0	100%	KEVRansomwarePoC ×9	Dec 10, 2021 KEV Dec 10, 2021
CVE-2021-44832	Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…	6.6	98%		Dec 28, 2021
CVE-2023-42793	Authentication bypass in JetBrains TeamCity enables unauthenticated RCE	9.8	100%	KEVRansomwarePoC ×2	Sep 19, 2023 KEV Oct 4, 2023

From the original article

3 min read at thehackernews.com

The notorious North Korea-linked threat actor known as the Lazarus Group has been attributed to a new global campaign that involves the opportunistic exploitation of security flaws in Log4j to deploy previously undocumented remote access trojans (RATs) on compromised hosts.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.