Log4J/Log4Shell Still Being Exploited

Log4J/Log4Shell is still being actively exploited, but the significant global attention of the vulnerability has prevented ongoing widespread exploitation, according to Tetra Defense.

Despite widespread attention brought to Log4J/Log4Shell vulnerabilities last December, as the calendar ticked forward into the new year, it was only the third most exploited external exposure in the quarter, accounting for 22% of Tetra Defense’s total incident response cases. Leading the way, and accounting for 33% of cases, were a series of Microsoft Exchange vulnerabilities known as ProxyShell, which were originally disclosed in August 2021.

“The most common system we see the Log4J vulnerability exploited on is VMware Horizon,” Holewinski said. “This is not because the attackers know exactly how to trigger the Log4J exploit on VMware Horizon, which makes it a repeatable process. Anyone who hasn’t fully updated Log4J to a non-vulnerable version is still at risk. That level of risk depends on how readily exploitable the outdated system is.”