Grey Noise | Analysis and review of CISA's Log4j report

Summary: CISA's Cyber Safety Review Board, established in May 2021, published its first report on July 11, 2022, covering the December 2021 Log4j event and citing GreyNoise as a primary source of ground truth. The Board assessed Log4j as an "endemic vulnerability" whose vulnerable instances will remain in systems for many years, perhaps a decade or longer, and recommended organizations prepare to address Log4j vulnerabilities for years to come and continue to report and escalate exploitation observations.
Why it matters: GreyNoise telemetry shows regular, often large volumes of Log4j activity from roughly 50 internet sources over a two-month window, and Iranian state-sponsored attackers were reported using the Log4j exploit in recent campaigns as the post was being prepared. CISA has also added over 460 new Known Exploited Vulnerabilities to its catalog, a jump in known attack surface for any team still unsure whether those entries exist in its environment.

Read the original at GreyNoise Blog ↗