CISA Releases Log4Shell-Related MAR

From May through June 2022, CISA responded to an organization that was compromised by an exploitation of an unpatched and unmitigated Log4Shell vulnerability in a VMware Horizon server. CISA analyzed five malware samples obtained from the organization’s network and released a Malware Analysis Report of the findings.

Users and administrators are encouraged to review MAR 10386789-1.v1 for more information. For more information on Log4Shell, see:

• Joint Cybersecurity Advisory (CSA) Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems,
• CISA’s Apache Log4j Vulnerability Guidance webpage,
• Joint CSA Mitigating Log4Shell and Other Log4j-Related Vulnerabilities, and
• CISA’s database of known vulnerable services on the CISA GitHub page.