IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Log4j vulnerability continues to stress CISOs

Avast's latest threat report also reveals the resurrection of the infamous Emotet botnet

The Log4j vulnerability was actively exploited by coinminers, remote access trojans (RATs), botnets, ransomware, and advanced persistent threats (APTs) in December 2021, according to Avast's Q4 2021 threat report.

Using the aformentioned vulnerability, malicious attackers can execute code remotely on any targeted computer.  

Avast's threat researchers have also observed a revival of the Emotet botnet, as well as an increase in coin mining activity by 40%. Both present risks to consumers and businesses alike, placing CISO departments under greater stress.

The security company's Q4 findings also indicate an increase in adware, technical support scams, subscription scams, and spyware targeting Android users. However, RAT and ransomware activity decreased in Q4.

Avast malware research director Jakub Kroustek said: “Towards the end of the year, the extremely dangerous, ubiquitous, and easy to abuse Log4j vulnerability made CISO departments sweat, and rightly so, as it was weaponized by attackers spreading everything from coinminers to bots to ransomware."

"On the other hand, we are happy to report decreases in RAT, information stealer, and ransomware attacks. RAT activity died down thanks to the holidays, with bad actors even going as far as copying the DcRat remote access Trojan and renaming it 'SantaRat',” added Kroustek.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

Aside from exploiting Log4j, threat actors exploited CVE-2021-40449 vulnerability, which elevates permissions for malicious processes through the Windows kernel driver. Attackers used the aforementioned vulnerability to download and run the MistarySnail RAT, according to Avast.

In addition, a malicious campaign abusing Microsoft Azure and Amazon Web Services (AWS) accounted for high NanoCore and AsyncRat detections. AWS and Azure were used as download servers for malware payloads during the campaign.

Even so, Avast reported a 28% decrease in ransomware risk ratio compared to Q3 2021.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022
Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022