CISA, Five Eyes issue guidance meant to slow Log4Shell attacks

The joint agencies "assess that exploitation of these vulnerabilities, especially Log4Shell, is likely to increase and continue over an extended period."

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency released Wednesday an advisory offering vendors and affected organizations a detailed guide on how to deal with potential risks to IT and cloud services posed by an exploit in Apache Log4j’s software library.

“This joint CSA expands on the previously published guidance by detailing steps that vendors and organizations with IT and/or cloud assets should take to reduce the risk posed by these vulnerabilities,” the advisory states.

The warning was issued alongside the FBI and National Security Agency and the security agencies of Five Eyes intelligence partners, Australia, Canada, New Zealand, the United Kingdom.

“Log4j vulnerabilities present a severe and ongoing threat to organizations and governments around the world; we implore all entities to take immediate action to implement the latest mitigation guidance to protect their networks,” CISA Director Jen Easterly said in a statement.

The alert follows previous guidance from CISA that organizations immediately patch for the vulnerability as well as an emergency directive last week that all U.S. federal civilian executive branch agencies need to assess their internet-facing systems for the vulnerability, known as Log4Shell, and immediately patch or mitigate by Dec. 23.

The guidance focuses on securing internet-facing devices and systems against Log4Shell-related attacks. However, the alert warns that Java is also ubiquitous throughout IT and OT systems and unsegmented networks present a risk of invaders moving laterally between systems. The alert warns organizations to treat any products that use Log4j as suspect and keep a meticulous record of patching in order to monitor for unusual behavior.

The joint agencies “assess that exploitation of these vulnerabilities, especially Log4Shell, is likely to increase and continue over an extended period” and “strongly urge all organizations to apply the recommendations…to identify, mitigate, and update affected assets.” The most recent patch was issued on Dec. 18.

CISA, FBI, and NSA previously released an alert providing organizations with details on a state-sponsored threat actor, including notes on previous malicious cyber operations as well as mitigations.

Researchers have already seen attackers rushing to use the bug to launch ransomware and cryptocurrency mining schemes. Researchers at Mandiant and Microsoft have also observed cybercriminals tied to the governments of China, Iran, North Korea and Turkey exploiting the vulnerability.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure