Loading story…
Threat actors, including suspected state-sponsored groups, continued exploiting Log4Shell (CVE-2021-44228) in unpatched public-facing VMware Horizon and Unified Access Gateway systems, according to a joint CISA and U.S. Coast Guard Cyber Command advisory. In confirmed incidents, attackers used the flaw for initial access, deployed malware disguised as SysInternals tools, established command-and-control, moved laterally over RDP, and in at least one case reached a disaster recovery network and exfiltrated sensitive data. The advisory highlighted artifacts including hmsvc.exe, SvcEdge.exe, odbccads.exe, praiser.exe, fontdrvhosts.exe, winds.exe, error_401.jsp, and newdev.dll, and urged organizations that delayed patching to assume compromise, isolate affected hosts, hunt for indicators, and upgrade to fixed VMware builds.
The vulnerability’s broad reach and difficult-to-observe execution paths also drove a wave of defensive tooling and monitoring guidance across the security community. Researchers released a Burp Suite Log4Shell Scanner that uses out-of-band DNS and LDAP-based callbacks to uncover hidden or asynchronous vulnerable services, while others published Suricata detection coverage, regex-based IOC matching for log review, and updated enterprise advisories from vendors including Red Hat, Sophos, Mandiant, and SANS. Reports also indicated exploitation activity had begun early, with botnets attempting to weaponize the flaw soon after disclosure, reinforcing that Log4Shell remained both a mass-scanning target and a high-impact intrusion vector long after patches became available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Mandiant published guidance on initial Log4Shell exploitation and mitigation recommendations, summarizing defensive considerations for organizations still managing the risk.
SC Media published a feature examining the numbers and impact one year after Log4Shell, marking a retrospective milestone in coverage of the vulnerability.
The log4shell-rex GitHub project was published to provide PCRE regex matching for Log4Shell indicators of compromise in logs.
Neo23x0 published Fenrir version 0.9.0 as a Log4Shell-focused release, adding tooling relevant to detection or response for the vulnerability.
A GitHub Gist published Suricata coverage for Log4Shell exploitation attempts, providing defenders with detection content for CVE-2021-44228 activity.
Silent Signal announced and released an open-source Burp Suite extension called Log4Shell Scanner to help defenders identify hidden Log4Shell-affected hosts using out-of-band detection.
SANS Internet Storm Center published follow-up content describing what it was seeing from Log4Shell activity and how defenders could respond and access related data.
Red Hat published security bulletin RHSB-2021-009 covering the Log4Shell remote code execution vulnerability in log4j and related response guidance.
ZDNet reported that remote code execution activity targeting Log4Shell began on 2021-12-01, with botnets starting to use the vulnerability before its broad public disclosure.
CISA and U.S. Coast Guard Cyber Command issued a joint advisory stating that multiple threat actors, including suspected state-sponsored actors, continued exploiting unpatched VMware Horizon and Unified Access Gateway systems after fixes became available in December 2021. The advisory also documented two confirmed incident-response cases involving malware deployment, lateral movement, and in one case data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcezeropath.com
Open sourcemandiant.com
Open sourcescworld.com
Open sourceisc.sans.edu
Open sourceaccess.redhat.com
Open sourcezdnet.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw in Apache Log4j, tracked as **`CVE-2021-44228`** and widely known as **Log4Shell**, exposed a vast range of Java applications and services to unauthenticated compromise through the library’s JNDI lookup feature. Security reporting said the bug affected Log4j versions **`2.0-beta9` through `2.14.1`**, with early warnings surfacing through attacks against Minecraft servers before researchers and vendors confirmed broader exposure across enterprise software, cloud services, and Apache frameworks including Struts2, Solr, Druid, Flink, and Kafka. Researchers also warned that exploitation could lead not only to remote code execution but also to leakage of sensitive environment data such as cloud credentials and developer secrets. Exploit code was released publicly and was quickly followed by heavy Internet-wide scanning and attack activity, including targeting of **VMware vCenter Server**, where VMware confirmed exploitation attempts in the wild and urged immediate mitigation. **CISA** described the flaw as one of the most serious vulnerabilities in recent memory and warned that **hundreds of millions of devices** could be affected, with likely follow-on abuse by cryptominers, ransomware operators, and other threat actors. Apache responded with a series of Log4j updates, including releases such as **`2.12.2`**, **`2.12.3`**, **`2.12.4`**, and **`2.3.1`**, while defenders published detection content and scanning tools as organizations raced to identify vulnerable systems and reduce exposure.
Jun 29, 2026
Apache Log4j remained at the center of a major software supply chain security crisis after **Log4Shell** (`CVE-2021-44228`) exposed Java applications to remote code execution through crafted requests that could force vulnerable systems to retrieve and run attacker-controlled payloads. The flaw affected Log4j `2.0-beta9` through `2.14.1`, was reported as easy to exploit, and was observed in widespread attacks across enterprise networks, prompting urgent calls to identify exposed assets and apply vendor fixes or mitigations. Remediation proved more complex as Apache issued updates and additional Log4j vulnerabilities emerged, including `CVE-2021-45046`, `CVE-2021-45105`, and `CVE-2021-44832`, raising concerns that patching alone would not address prior compromise or attacker persistence. Organizations were pushed to combine software updates with threat hunting and incident response, while defenders also relied on community tracking of affected products through resources such as CISA's `log4j-affected-db`, which has since been archived as read-only.
Jul 16, 2026
Attackers actively exploited **VMware Workspace ONE Access**, **Identity Manager**, and **vRealize Automation** flaws in the wild, with **`CVE-2022-22954`** emerging as the primary initial access vector. Palo Alto Networks Unit 42 said exploitation began shortly after VMware disclosed the issue, describing the bug as a trivial server-side template injection that can be triggered with a single HTTP request for remote code execution. The activity prompted a **CISA alert**, and researchers warned that related VMware flaws **`CVE-2022-22972`** and **`CVE-2022-22973`** were also highly likely to be targeted. Observed post-exploitation activity included deployment of **Mirai** and **Gafgyt** variants, **Enemybot**, webshells, Perl-based shellbots, coinminers, and payloads that modified SSH keys for persistence. Unit 42 reported that attackers could chain **`CVE-2022-22960`** after the initial compromise to escalate privileges to root by abusing writable paths and sudo-accessible scripts. The company said its Threat Prevention signature **`92483`** blocks exploitation attempts and noted that **about 800 internet-exposed Workspace ONE Access instances** were visible, underscoring the exposure risk for unpatched organizations.
Jun 29, 2026