Friday, February 7, 2025
HomeCVE/vulnerabilityChinese Hackers Exploiting Log4Shell Vulnerability & Attack Internet-Facing Systems

Chinese Hackers Exploiting Log4Shell Vulnerability & Attack Internet-Facing Systems

Published on

SIEM as a Service

Follow Us on Google News

The Chinese hackers are actively exploiting the Log4Shell Vulnerability in the Log4j library and it is identified as “CVE-2021-44228.”

Microsoft experts have claimed that Chinese hackers are targeting the companies and individuals with a new ransomware strain for double extortion, “Night Sky.”

In this ongoing ransomware operation, the hackers are exploiting the CVE-2021-44228 which is marked as one of the most critical flaws, and by exploiting this vulnerability they are also attacking the internet-facing systems as well.

On December 27, 2021, the hackers started this ransomware operation in which they compromised the corporate networks of two well-known organizations Bangladesh and Japan.

For their victims on the Tor network, they have finely set up a leak site where they will publish the data that was stolen from the victims who have not paid the ransom.

Night Sky & Its Operators

While this ransomware family was initially spotted by the cybersecurity researchers of MalwareHunterteam, they noted that when this ransomware encrypts a file it put “.nightsky” as an extension of that encrypted file.

Here’s what the company spokesperson stated:-

“The security of our customers is our top priority at VMware as we respond to the industry-wide Apache Software Foundation Log4j vulnerabilities. Any service connected to the internet and not yet patched for Log4j vulnerabilities is vulnerable to hackers, and VMware strongly recommends taking immediate action.”

Moreover, the security experts at Microsoft have tracked the Chinese hacking group as, “DEV-0401,” they are found to be exploiting the Log4Shell flaw on VMware Horizon systems that are exposed.

Earlier, this same Chinese hacking group has deployed and exploited multiple ransomware, and among them, the most popular ones are:-

  • LockFile
  • AtomSilo
  • Rook

Here to make things legit the operators of Night Sky ransomware has used the C2 servers that mimic the domains of security and IT companies like:-

  • Trend Micro
  • Sophos
  • Nvidia
  • Rogers Corporation

Hackers are constantly targeting the networks of vulnerable organizations and individuals, and along with financially motivated hackers, the state-sponsored threat actors from countries like China, North Korea, Turkey, and Iran are also exploiting the bug.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Former Google Engineer Charged for Allegedly Stealing AI Secrets for China

A federal grand jury has indicted Linwei Ding, also known as Leon Ding, a...

Dell Update Manager Plugin Flaw Exposes Sensitive Data

Dell Technologies has issued a security advisory (DSA-2025-047) to address a vulnerability in the Dell Update...

DeepSeek iOS App Leaks Data to ByteDance Servers Without Encryption

DeepSeek iOS app—a highly popular AI assistant recently crowned as the top iOS app...

Critical Flaws in HPE Aruba ClearPass Expose Systems to Arbitrary Code Execution

Hewlett Packard Enterprise (HPE) has issued a high-priority security bulletin addressing multiple vulnerabilities in...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Dell Update Manager Plugin Flaw Exposes Sensitive Data

Dell Technologies has issued a security advisory (DSA-2025-047) to address a vulnerability in the Dell Update...

Critical Flaws in HPE Aruba ClearPass Expose Systems to Arbitrary Code Execution

Hewlett Packard Enterprise (HPE) has issued a high-priority security bulletin addressing multiple vulnerabilities in...

F5 BIG-IP SNMP Flaw Allows Attackers to Launch DoS Attacks

A recently disclosed vulnerability in F5's BIG-IP systems has raised alarm within the cybersecurity...