APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit
research.checkpoint.com · 11 Jan 2022 · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗
To exploit the Log4j vulnerability (CVE-2021-44228), the attackers chose one of the publicly available open-source JNDI Exploit Kits, since removed from GitHub due to its enormous popularity following the vulnerability emergence.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.