APT ‘Aquatic Panda’ Targets Universities with Log4JShell Exploit Tools

As per the research released by CrowdStrike, experts disrupted an unusual activity by the threat group using some Log4Shell exploit tools on a weak VMware installation during the attack involving a big unknown academic institution.
Like many other security organizations, CrowdStrike was analyzing threat activities around CVE-2021-44228 vulnerability and colloquially called Log4Shell. In early December, it was present in the Apache Log4j logging library and instantly set upon by hackers.
Because of its common use, a number of infrastructure products from Twitter, CloudFlare, Apple, Microsoft, etc are now vulnerable to Log4Shell threat activities. Researchers showed that multiple components of VMware Horizon service were also vulnerable to Log4j exploits, leading OverWatch to include a service named VMware Horizon Tomcat to the processes-to-watch list.
Furthermore, researchers speculated that the Log4j exploit’s updated version was used during the actions of threat actors’ operations. The infrastructure utilized in these attacks was linked to Aquatic Panda.
#Log4J #vulnerability #cybersecurity #news