Malware – Log4Shell exploits implant cryptocurrency miner DEC-2021
Uncategorized December 28th, 2021On unpatched Apache web server systems, SANS ISC shares how Log4Shell exploits can implant cryptocurrency miners
While following Log4Shell’s exploit attempts hitting our honeypots, I came across another campaign trying to push a crypto miner on the victim’s machines. The previous campaign I analyzed used a simple post-exploitation Powershell script to download and launch the coin miner xmrig. The new one uses a .Net launcher to download, decrypt, and execute the binaries. So far, we’ve been able to identify a few different types of attacks against our honeypots trying to take advantage of Log4Shell. Crypto miner implants are prevalent
