{ "id": "989df6e3-6c5f-4ba5-a893-a9b0c23c2bdb", "created_at": "2026-04-06T00:11:03.2517Z", "updated_at": "2026-04-10T03:34:59.809289Z", "deleted_at": null, "sha1_hash": "0983ec78f0ef63804c418efd877a3083db665895", "title": "Log4shell exploits now used mostly for DDoS botnets, cryptominers", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1375394, "plain_text": "Log4shell exploits now used mostly for DDoS botnets, cryptominers\r\nBy Bill Toulas\r\nPublished: 2022-03-02 · Archived: 2026-04-05 23:16:17 UTC\r\nThe Log4Shell vulnerabilities in the widely used Log4j software are still leveraged by threat actors today to deploy various\r\nmalware payloads, including recruiting devices into DDoS botnets and for planting cryptominers.\r\nAccording to a report by Barracuda, the past couple of months were characterized by dips and spikes in the targeting of\r\nLog4Shell, but the volume of exploitation attempts has remained relatively constant.\r\nAfter analyzing these attacks, Barracuda determined that most exploitation attempts came from US-based IP addresses,\r\nfollowed by Japan, central Europe, and Russia.\r\nhttps://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nAttacker IPs heatmap (Barracuda)\r\nIn December 2021, researchers found Log4j version 2.14.1 and all previous versions to be vulnerable to CVE-2021-44228,\r\ndubbed \"Log4Shell,\" a critical zero-day remote code execution flaw.\r\nApache, the developer of Log4j, attempted to resolve the issue by releasing version 2.15.0. However, subsequent\r\nvulnerability discoveries and security gaps extended the patching race until the end of the year, when version 2.17.1 finally\r\naddressed all problems.\r\nHowever, according to Barracuda, many systems continue to run older versions of the popular logging framework and are\r\nthus vulnerable to exploitation.\r\nLeveraged for DDoS and mining\r\nBarracuda researchers have spotted various payloads targeting vulnerable Jog4j deployments, but the Mirai botnet\r\nderivatives appear to take the lion's share at this moment.\r\nThe Mirai malware targets publicly exposed network cameras, routers, and other devices and enlists them into a botnet of\r\nremotely controlled bots. The threat actor can then control this botnet to perform DDoS attacks against a specific target,\r\ndepleting their resources and disrupting their online service.\r\nAs Barracuda's report explains, Mirai is distributed in various forms and from different sources, indicating that the operators\r\nare attempting to build a large botnet that targets victims of all sizes in the future.\r\nThe threat actors behind these operations are either renting their botnet firepower to others or are launching DDoS attacks\r\nthemselves to extort companies.\r\nOther payloads seen dropped by recent Log4j exploitation include:\r\nBillGates malware (DDoS)\r\nKinsing (cryptominer)\r\nXMRig (cryptominer)\r\nMuhstik (DDoS)\r\nhttps://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nPage 3 of 5\n\nScript to set up the miner (Barracuda)\r\nBarracuda's analysts say they did not see ransomware gangs exploiting publicly exposed VMWare installations and believe\r\nit's being used more as an insider threat for already compromised networks.\r\nFor example, the Conti Ransomware used Log4j exploits to spread laterally to VMware vCenter installations\r\nA permanent threat\r\nThe simplest way to protect against these types of attacks is to update Log4j to version 2.17.1 or later and keep all your web\r\napplications up to date in general.\r\nAs most of the devices targeted by Mirai do not allow you to update individual packages, you will need to check for updated\r\nfirmware that contains Log4j fixes and apply them if available.\r\nWhile Barracuda reports seeing a steady volume of Log4Shell attacks, Sophos has recently reported a decline. However, all\r\nanalysts agree that the threat remains.\r\nVolume of attacks targeting Log4j (Barracuda)\r\nhttps://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nPage 4 of 5\n\nEven if the interest of the majority of threat actors fades, some will continue to target vulnerable Log4j deployments since\r\ntheir numbers remain notable.\r\nValuable organizations that were lucrative for ransomware attacks have applied the security updates, but for purposes of\r\ncryptomining and DDoS attacks, neglected systems that run older versions are excellent targets.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nhttps://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/" ], "report_names": [ "log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers" ], "threat_actors": [ { "id": "a6c351ea-01f1-4c9b-af75-cfbb3b269ed3", "created_at": "2023-01-06T13:46:39.390649Z", "updated_at": "2026-04-10T02:00:03.311299Z", "deleted_at": null, "main_name": "Kinsing", "aliases": [ "Money Libra" ], "source_name": "MISPGALAXY:Kinsing", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434263, "ts_updated_at": 1775792099, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0983ec78f0ef63804c418efd877a3083db665895.pdf", "text": "https://archive.orkl.eu/0983ec78f0ef63804c418efd877a3083db665895.txt", "img": "https://archive.orkl.eu/0983ec78f0ef63804c418efd877a3083db665895.jpg" } }