#Log4J Worm is ITW
@vxunderground has a sample of the self propagating worm using log4j as a vector.
It installs a Mirai bot which makes sense to targeting embedded Linux devices
Looks like it uses user-agent for exploitation and modifies the binary before sending (?)
@vxunderground has a sample of the self propagating worm using log4j as a vector.
It installs a Mirai bot which makes sense to targeting embedded Linux devices
Looks like it uses user-agent for exploitation and modifies the binary before sending (?)
From what I can quickly reverse engineer it looks like this malware is targeting mainly Huawei routers
Very very similar to CVE-2017-17215
For reference:
securitynews.sonicwall.com/xmlpost/new-wa…
Very very similar to CVE-2017-17215
For reference:
securitynews.sonicwall.com/xmlpost/new-wa…
This variant will quickly get modified and used and repurposed to exploit other hardware and devices.
Welcome to the age of the log4j worms everyone.
🪵🪱
Welcome to the age of the log4j worms everyone.
🪵🪱
Impact of this worm is unknown, I have no idea how many devices this will compromise but it could set up quite a large botnet for launching DDoS and other services in order to gain money.
My guess: Expect DDoS attempts to escalate around Xmas
Expect other variants soon
My guess: Expect DDoS attempts to escalate around Xmas
Expect other variants soon
As someone who used to be a VXer and wrote several worms in early 2000s there is some developmental time frames for these pieces of malware.
- Research propagation method
- Add it to base viral code
- Test in a limited environment
- Rewrite and retest
- release into wild later
- Research propagation method
- Add it to base viral code
- Test in a limited environment
- Rewrite and retest
- release into wild later
The time for release is never immediately after development
Releasing into the wild requires window of opportunity, removal of evidence of meta data and author, destroying hardware that created it on, and deploying it in a fashion that can't be traced back to you.
Releasing into the wild requires window of opportunity, removal of evidence of meta data and author, destroying hardware that created it on, and deploying it in a fashion that can't be traced back to you.
Huge shout out to @1ZRR4H who discovered this in the wild and posted it to @vxunderground who continue to be the best source for malware research on the internet bar none.
Also if possible please make sure you donate, subscribe, and give samples to VXU to support their services
Also if possible please make sure you donate, subscribe, and give samples to VXU to support their services
And finally CC: @vmyths
My timing was aggressive, but time between development and deploy and discovery was imho pretty close
All the features I mentioned in the original post appear to be lined up in this as well.
Future variants on the way
My timing was aggressive, but time between development and deploy and discovery was imho pretty close
All the features I mentioned in the original post appear to be lined up in this as well.
Future variants on the way
Link to log4j worm
https://twitter.com/vxunderground/status/1472782879931473921?t=5dX-k8i8ujhG9zkAHNgGBQ&s=19
• • •
Missing some Tweet in this thread? You can try to
force a refresh
