Log4Shell threat remains extremely high

The quantity of cyber attacks targeting the Log4Shell complex of vulnerabilities in Log4j still remains extremely high, according to Barracuda Networks. 

New Threat Spotlight analysis from cloud-enabled security solutions provider Barracuda Networks says that while he Log4Shell vulnerabilities have now been around for more than two months, the volume of attacks attempting to exploit these vulnerabilities has remained relatively constant, with a few dips and spikes, over the past two months.

It is predicted that this attack pattern will continue, given the popularity of the software, the exploitability of the vulnerability, and the payoff when a compromise happens.

Geographically, Barracuda Networks uncovered that 83 per cent of the attacks on their systems came from IP addresses in the United States, with 50 per cent being associated with Amazon Web Services and other large data centres.

Threats analysed also came from Japan, Germany, Netherlands, and Russia.

The UK National Cyber Security Centre have previously advised individuals and businesses to be wary of the threat and to ensure all devices are regularly updated.

Log4Shell is a Java-based error logging audit framework which is an Apache project, and is utilised by many major organisations such as Apple, Amazon and Twitter. Hackers can breach devices running the vulnerabilities to break into IT systems and steal passwords, extract data and infect networks with malicious software.

Researchers at Barracuda Networks found a variety of threats ranging from videos of Rick Astley’s Never Gonna Give You Up, cryptocurrency mining payloads, and Distributed Denial of Service (DDoS) malware. They predict that threat actors are working to build out a large botnet and there should be an expectation of large DDoS attacks in the near future.

“Due to the growing number of vulnerabilities found in web applications, it is getting progressively more complex to guard against attacks,” said Tushar Richabadas, product marketing manager, Barracuda Networks.

“The best way to protect against Log4Shell specifically is to upgrade to the latest version of Log4J. Maintaining up-to-date software and libraries helps ensure that…