Microsoft has issued frequent updates on the Log4j vulnerability that we have been hearing so much about. The vulnerability is a serious problem that will become more widespread as time goes on.
According to Microsoft’s threat intelligence team:
“The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only applications that use vulnerable libraries, but also any services that use these applications, so customers may not readily know how widespread the issue is in their environment. Customers are encouraged to utilize scripts and scanning tools to assess their risk and impact. Microsoft has observed attackers using many of the same inventory techniques to locate targets. Sophisticated adversaries (like nation-state actors) and commodity attackers alike have been observed taking advantage of these vulnerabilities. There is high potential for the expanded use of the vulnerabilities.”
The threat intelligence team has observed “mass scanning by attackers” trying to find vulnerable systems to attack, and nation-state activity by groups in China, Iran, North Korea and Turkey currently experimenting on how to carry out attacks. It is only a matter of time before they are successful.
Further, in the last week, the threat intelligence team identified that a China-based ransomware group, dubbed DEV-0401, “started exploiting the CVE-2021-44228 vulnerability in internet-facing systems running VMware Horizon. Our investigation shows that successful intrusions in these campaigns led to the deployment of the NightSky ransomware.” This group has successfully deployed ransomware in the past and is “using command and control…servers that spoof legitimate domains.”
Microsoft released new threat and vulnerability management capabilities on January 11, 2022.