Log4Shell-IOCs
Members of the Curated Intelligence Trust Group have compiled a list of IOC feeds and threat reports focused on the recent Log4Shell exploit targeting CVE-2021-44228 in Log4j. (Blog | Twitter | LinkedIn)
Analyst Comments:
- 2021-12-13
- IOCs shared by these feeds are
LOW-TO-MEDIUM CONFIDENCEwe strongly recommendNOTadding them to a blocklist - These could potentially be used for
THREAT HUNTINGand could be added to aWATCHLIST - Curated Intel members at various organisations recommend to
FOCUS ON POST-EXPLOITATION ACTIVITYby threats leveraging Log4Shell (ex. threat actors, botnets) - IOCs include JNDI requests (LDAP, but also DNS and RMI), cryptominers, DDoS bots, as well as Meterpreter or Cobalt Strike
- Critical IOCs to monitor also include attacks using DNS-based exfiltration of environment variables (e.g. keys or tokens), a Curated Intel member shared an example
- IOCs shared by these feeds are
- 2021-12-14
- Curated Intel members profiled active exploitation threats
- 2021-12-15
- Curated Intel members parsed
MEDIUM CONFIDENCE FEEDSto beMISP COMPATIBLEwith the help of the KPMG-Egyde CTI Team - Curated Intel members profiled active threat groups (nation states and organized crime)
- Curated Intel members parsed
- 2021-12-16
- Curated Intel members confirmed the previously unnamed “New Ransomware” is actually “TellYouThePass Ransomware“, mostly targeting Chinese infrastructure
- 2021-12-17
- Curated Intel members parsed
VETTED IOCswith the help of the Equinix Threat Analysis Center (ETAC) - ETAC has also shared a diagram of threat actors, malware, and botnets, leveraging Log4Shell in the wild
- Curated Intel members parsed
- 2021-12-20
- ETAC has added MITRE ATT&CK TTPs of Threat Actors leveraging Log4Shell
- Curated Intel members parsed
ALIENVAULT OTX MENTIONSto beMISP COMPATIBLEwith the help of the KPMG-Egyde CTI Team
- 2021-12-21
- Curated Intel members parsed
VULNERABLE PRODUCT LISTSto beCSV+XLSX COMPATIBLEwith an automated workflow, pulling from NCSC-NL + CISA + Swifthak
- Curated Intel members parsed
Indicators of Compromise (IOCs)
Threat Reports
Payload Examples
Threat Profiling
Threat Groups
| Grouping | Actor | Mentioned Alias | Other Alias EternalLiberty | Threat Report | Note |
|---|---|---|---|---|---|
| State actor | China | HAFNIUM | N/A | MSTIC (2) | Attacking infrastructure to extend their typical targeting. In these attacks, HAFNIUM-associated systems were observed using a DNS service typically associated with testing activity to fingerprint systems. |
| State actor | Iran | PHOSPHORUS | APT35, TEMP.Beanie, TA 453, NewsBeef, CharmingKitten, G0003, CobaltIllusion, TG-2889, Timberworm, C-Major, Group 41, Tarh Andishan, Magic Hound, Newscaster | MSTIC (2) | Iranian actor that has been deploying ransomware, acquiring and making modifications of the Log4j exploit. |
| Organized Cybercrime | Russia | Wizard Spider | Trickbot Gang, FIN12, GOLD BLACKBURN, Grim Spider | AdvIntel | Wizard Spider is the developer of the Conti Ransomware-as-a-Service (RaaS) operation which has a high number of affiliates, and a Conti affiliate has leveraged Log4Shell in Log4j2 in the wild |
| Organized Cybercrime | Russia | EvilCorp | Indrik Spider, GOLD DRAKE | Cryptolaemus | EvilCorp are the developers of the Dridex Trojan, which began life as a banking malware but has since shifted to support the delivery of ransomware, which has included BitPaymer, DoppelPaymer, Grief, and WastedLocker, among others. Dridex is now being dropped following the exploitation of vulnerable Log4j instances |
