Fidelis Cybersecurity
Fidelis Blog
Adam Brown
Private: Adam Brown
Manager of Threat Intelligence

Adam has over 12 years of collective intelligence experience – with 8 years in Cyber Threat Intelligence (CTI) distributed across various disciplines which include: incident response, malware analysis,... Read More


Log4Shell Active Exploitation Continues…

Latest Threat Activity and Fidelis Response  

Key Developments | 17 December 2021 
Multiple high-fidelity sources continue to report that cyber threat actors of various skill and motivation are leveraging this vulnerability to either deliver their primary payload (e.g., cryptocurrency mining malware) or establish initial access into the victim environment (e.g., Cobalt Strike), which will almost certainly lead to more intrusion chains of various sophistication. While we have yet to directly observe Cobalt Strike use, Fidelis Threat Research Team (TRT) has observed an exorbitant amount of Linux/Unix command shell injection in the week since the disclosure of the Log4shell vulnerability. 

Cryptocurrency Miners 

  • In a recent instance Fidelis TRT observed exploitation attempts against an industry-leading technology manufacturer and services provider. 
  • In many case attempts were NOT successful, but followed an intrusion TTP identical that reported in open-source channels for threat actors delivering cryptocurrency mining malware (Ref: Figures 1 and 2 below).

figure1Figure 1. Log4shell exploitation attempts from actors most likely deploying crypocurrency miners – source: Fidelis Telemetry


Figure 2. Log4shell exploitation attempts from actors most likely deploying crypocurrency miners – image credit: BleepingComputer

Command Shell Injection

  • In numerous instances, Fidelis TRT observed attempts at *nix command shell injection following exploitation of Log4shell (Ref: Figures 3 and 4 below).
  • In many cases, this was NOT successful concerning the targeted servers under our purview.
  • However impact in less-securely configured environments is likely; wherein such commands would allow command shell execution under the privilege context of the webserver daemon.

figure3Figure 3. Command shell injections following Log4shell, using WGET – source: Fidelis Telemetry

Figure 4. Command shell injections following Log4Shell, using CURL – source: Fidelis Telemetry

Fidelis Response
Fidelis TRT continues to ehance our detection logic primarily through direct collection and analysis of live attack telemetry data and broader observations through industry partnerships and vetted open-source intelligence.

  • In numerous instances this week, TRT observed threat actors attempting to subvert Web Application Firewalls (WAF). We are detecting and alerting on such attempts (Ref: Figure 5 below) and discovering threat actor TTP pivots using our logic.

figure5Figure 5. Fidelis dynamic detection alert firing on WAF evasion (HTTP User-Agent) for Log4Jshell  – source: Fidelis Telemetry


IPv4 and Port(s)

FQDN and Subdomain(s)

Network Relevant Strings

Stay up to date on all things security

Subscribe to the Threat Geek Blog