logo
DATABASE RESOURCES PRICING ABOUT US

Google Blows Lid Off Conti, Diavol Ransomware Access-Broker Ops

2022-03-18T14:49:01

Description

Google’s Threat Analysis Group (TAG) has provided a rare look inside the operations of a cybercriminal dubbed “Exotic Lily,” that appears to serve as an initial-access broker for both Conti and Diavol ransomware gangs. Researchers’ analysis exposes the business-like approach the group takes to brokering initial access into organizations’ networks through a range of tactics so its partners can engage in further malicious activity. While ransomware actors tend to get most of the attention, they can’t do their dirty work without first gaining access to an organization’s network. This is often the job of what are called initial-access brokers (IABs), or “the opportunistic locksmiths of the security world,” as Google TAG calls them in [a blog post](<https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/>) published Thursday. “It’s a full-time job,” Google TAG researchers Vlad Stolyarov and Benoit Sevens wrote in the post. “These groups specialize in breaching a target in order to open the doors — or the Windows — to the malicious actor with the highest bid.” Google TAG first encountered Exotic Lily last September, when the group was doing just that — exploiting the [zero-day Microsoft flaw](<https://threatpost.com/microsoft-mshtml-ryuk-ransomware/174780/>) in MSHTML ([CVE-2021-40444](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444>)) as part of what turned out to be a full-time IAB business “closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol,” researchers wrote. At the peak of the group’s activity, Exotic Lily — which researchers believe is working with the Russian cybercrime gang known as FIN12, [Wizard Spider](<https://threatpost.com/wizard-spider-upgrades-ryuk-ransomware/149853/>) or DEV-0413 — was sending more than 5,000 emails a day to as many as 650 targeted organizations globally, they said. “Up until November 2021, the group seemed to be targeting specific industries such as IT, cybersecurity and healthcare, but as of late we have seen them attacking a wide variety of organizations and industries, with less specific focus,” researchers wrote in the post. ## **Soup to Nuts** Exotic Lily works ostensibly as a full-time cybercrime business, which might be described as a “soup to nuts” organization if it were actually a legitimate company. The group has maintained a “relatively consistent attack chain” during the time it was being tracked by researchers with its operators “working a fairly typical 9-to-5 job, with very little activity during the weekends,” researchers wrote. Working hours indicated that the group is likely operating out of a Central or Eastern European time zone. The group’s tactics include initial activity to build fake online personas—including social-media profiles with AI-generated photos—that spoof both identities and company domains to ensure it appears as an authentic entity to its targets when carrying out phishing, researchers revealed. In fact, in November, Google TAG observed the group impersonating real company employees by copying their personal data from social media and business databases such as RocketReach and CrunchBase. “In the majority of cases, a spoofed domain name was identical to a real domain name of an existing organization, with the only difference being a change of TLD to “.us”, “.co” or “.biz,” researchers wrote. ## **Full-Time Phishing Business** While bug exploitation is part of its work as noted, Exotic Lily’s main business operation is to use these spoofed email accounts to send [spear-phishing](<https://threatpost.com/spear-phishing-exploits-glitch-steal-credentials/176449/>) emails. They often purport to be a business proposal, such as seeking to outsource a software-development project or an information-security service. One unique aspect of the group’s method is to engage in more follow-up communications with targets than most cybercriminals behind phishing campaigns typically do, researchers observed. This activity includes operators’ attempting to schedule a meeting to discuss a project’s design or requirements or engaging in other communication to gain affinity and trust, they said. In its final attack stage, Exotic Lily uploads an ultimate payload to a public file-sharing service such as TransferNow, TransferXL, WeTransfer or OneDrive, and then uses a built-in email notification feature to share the file with the target. This tactic serves to help the group’s malicious motives evade detection, as the final email originates from the email address of a legitimate file-sharing service and not the attacker’s email, researchers noted. ## **Payload Delivery** Typically, the actors upload another group’s malware to the file-sharing service prior to sharing it with the target, researchers said. While some samples of malware appear custom, Google TAG doesn’t think it’s Exotic Lily who’s developing these binaries. Though their first observation of the group was the use of documents exploiting the MSHTML bug, researchers later observed Exotic Lily changing its delivery tactics to use ISO archives that include shortcuts to the [BazarLoader dropper](<https://threatpost.com/bazarloader-malware-slack-basecamp/165455/>), according to the post. This month, Google observed the group delivering ISO files with a custom loader that drops malware dubbed Bumblebee, which uses Windows Management Instrumentation (WMI) to collect various system details such as OS version, username and domain name. These details are then exfiltrated in JSON format to a command-and-control server (C2), researchers said. Bumblebee also can execute commands and code from the C2, and in recent activity was seen fetching Cobalt Strike payloads to be executed on targeted systems, they added. **_Moving to the cloud? Discover emerging cloud-security threats along with solid advice for how to defend your assets with our _**[**_FREE downloadable eBook_**](<https://bit.ly/3Jy6Bfs>)**_, “Cloud Security: The Forecast for 2022.”_** **_We explore organizations’ top risks and challenges, best practices for defense, and advice for security success in such a dynamic computing environment, including handy checklists._**


Related


threatpost
info

MSHTML Flaw Exploited to Attack Russian Dissidents

2022-03-30T13:13:49
threatpost
info

Microsoft MSHTML Flaw Exploited by Ryuk Ransomware Gang

2021-09-17T12:07:59
threatpost
info

Microsoft, CISA Urge Mitigations for Zero-Day RCE Flaw in Windows

2021-09-08T12:24:51
threatpost
info

Cyberattackers Target UPS Back-Up Power Devices in Mission-Critical Environments

2022-03-30T17:14:57
threatpost
info

DarkHotel APT Targets Wynn, Macao Hotels to Rip Off Guest Data

2022-03-18T18:53:40
threatpost
info

Novel Attack Turns Amazon Devices Against Themselves

2022-03-07T21:30:12
threatpost
info

Tax-Season Scammers Spoof Fintechs, Including Stash, Public

2022-03-24T13:00:16
threatpost
info

UK Cops Collar 7 Suspected Lapsus$ Gang Members

2022-03-24T21:23:30
threatpost
info

Microsoft Teams Targeted With Takeover Trojans

2022-02-17T14:11:48
threatpost
info

Exchange Servers Speared in IcedID Phishing Campaign

2022-03-29T14:02:41
threatpost
info

Samsung Confirms Lapsus$ Ransomware Hit, Source Code Leak

2022-03-07T19:28:36
threatpost
info

What the Log4Shell Bug Means for SMBs: Experts Weigh In

2021-12-14T17:54:47
threatpost
info

Where the Latest Log4Shell Attacks Are Coming From

2021-12-13T19:00:01
threatpost
info

Russia Issues Its Own TLS Certs

2022-03-11T18:34:34
threatpost
info

Medusa Malware Joins Flubot's Android Distribution Network

2022-02-07T22:13:29
threatpost
info

The 5 Most-Wanted Threatpost Stories of 2021

2021-12-27T18:57:24
threatpost
info

Relentless Log4j Attacks Include State Actors, Possible Worm

2021-12-15T23:18:44
threatpost
info

DOJ Indicts Russian Gov’t Employees Over Targeting Power Sector

2022-03-25T21:25:17
threatpost
info

Russia May Use Ransomware Payouts to Avoid Sanctions

2022-03-10T14:10:04
threatpost
info

TA2541: APT Has Been Shooting RATs at Aviation for Years

2022-02-15T14:02:07
threatpost
info

Sextortion Rears Its Ugly Head Again

2022-02-23T17:20:41
threatpost
info

'Appalling' Riot Games Job Fraud Takes Aim at Wallets

2021-12-10T19:00:36
threatpost
info

Multi-Ransomwared Victims Have It Coming–Podcast

2022-03-10T14:00:32
threatpost
info

Daxin Espionage Backdoor Ups the Ante on Chinese Malware

2022-03-01T17:55:46
trellix
info

Beyond Memory Corruption Vulnerabilities – A Security Extinction and Future of Exploitation

2022-01-24T00:00:00
trellix
info

Prime Minister’s Office Compromised: Details of Recent Espionage Campaign

2022-01-25T00:00:00
trellix
info

Trellix Global Defenders: Defending against Cyber Espionage Campaigns – Operation Graphite

2022-06-20T00:00:00
trellix
info

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

2022-07-19T00:00:00
trellix
info

Log4J and The Memory That Knew Too Much

2022-01-19T00:00:00
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-11T15:33:41
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-11T09:21:29
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-11T16:31:05
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-10T16:55:53
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-16T10:14:08
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-10-24T23:17:12
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-10T09:43:41
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-10-03T01:13:42
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-12T09:27:40
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-09T15:43:08
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-11-25T05:13:05
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-14T20:32:28
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-24T10:59:34
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-11T05:31:52
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-12-28T06:33:25
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2023-06-05T02:27:21
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-08T08:32:40
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-29T10:35:55
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-15T22:34:35
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-16T16:54:50
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-11-22T13:29:20
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-10-28T14:55:46
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-12-19T08:16:07
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-10-16T07:07:26
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-19T19:46:28
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-09T02:30:26
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-11T02:49:37
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-12T18:05:53
githubexploit
exploit

Exploit for Path Traversal in Microsoft

2021-09-14T13:45:36
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-14T17:10:48
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-14T22:19:29
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2022-01-03T04:36:41
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-11T15:48:03
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T05:14:05
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-12T15:29:20
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-21T08:13:35
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2022-01-27T07:07:30
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T17:23:47
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-14T19:29:11
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-22T15:15:12
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-18T19:30:35
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-13T11:29:57
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-22T09:15:47
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-11T16:08:47
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-15T18:51:07
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-20T01:31:06
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-10T21:13:46
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-13T15:04:31
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-11T01:08:00
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-14T14:51:26
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-12T14:05:05
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2022-01-09T13:38:38
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-09T21:49:33
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-10T23:34:52
githubexploit
exploit

Exploit for Expression Language Injection in Apache Log4J

2021-12-15T15:42:06
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-21T15:00:58
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-13T08:51:56
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-12T13:00:38
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-13T11:29:57
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-20T10:40:32
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-13T04:14:18
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2022-01-13T01:53:17
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-10T05:23:44
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-14T14:46:08
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-10T12:35:30
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2022-04-17T11:01:24
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T04:20:40
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-17T19:50:40
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

2021-12-11T12:41:38
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T15:58:14
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2022-01-05T22:25:42
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2022-08-25T21:35:32
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T01:50:22
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2023-03-20T12:13:13
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T10:06:07
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-17T08:48:59
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-20T17:59:56
githubexploit
exploit

Exploit for Improper Input Validation in Apache Log4J

2021-12-16T12:20:00
mmpc
blog

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

2021-09-15T23:40:56
talosblog
blog

Threat Source newsletter (March 9, 2023) — Stop freaking out about ChatGPT

2023-03-09T19:00:12
zdt
exploit

Microsoft Office Word MSHTML Remote Code Execution Exploit

2021-12-09T00:00:00
rapid7blog
info

Metasploit Wrap-Up

2021-12-10T21:36:13
rapid7blog
info

Log4Shell Makes Its Appearance in Hacker Chatter: 4 Observations

2021-12-14T21:05:17
rapid7blog
info

3 Reasons to Join Rapid7’s Cloud Security Summit

2022-03-09T17:06:13
rapid7blog
info

[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability

2022-01-19T21:47:30
rapid7blog
info

What's New in InsightVM and Nexpose: Q1 2022 in Review

2022-04-19T17:52:17
thn
info

Hackers Using Microsoft MSHTML Flaw to Spy on Targeted PCs with Malware

2021-11-25T11:33:00
thn
info

New Exploit Lets Malware Attackers Bypass Patch for Critical Microsoft MSHTML Flaw

2021-12-22T07:45:00
thn
info

Windows MSHTML 0-Day Exploited to Deploy Cobalt Strike Beacon in Targeted Attacks

2021-09-16T07:19:00
thn
info

Watch Out! Researchers Spot New Microsoft Office Zero-Day Exploit in the Wild

2022-05-30T09:40:00
thn
info

Hackers Exploited MSHTML Flaw to Spy on Government and Defense Targets

2022-01-25T14:04:00
thn
info

Hackers Using PowerPoint Mouseover Trick to Infect Systems with Malware

2022-09-28T10:09:00
thn
info

New 0-Day Attack Targeting Windows Users With Microsoft Office Documents

2021-09-08T03:37:00
thn
info

Hackers Increasingly Using 'Browser-in-the-Browser' Technique in Ukraine Related Attacks

2022-03-31T13:02:00
thn
info

Google Uncovers 'Initial Access Broker' Working with Conti Ransomware Gang

2022-03-18T07:31:00
thn
info

Cybercriminals Exploit Microsoft Word Vulnerabilities to Deploy LokiBot Malware

2023-07-17T09:04:00
metasploit
exploit

Microsoft Office Word Malicious MSHTML RCE

2021-11-09T11:18:58
checkpoint_advisories
info

Microsoft Internet Explorer MSHTML Remote Code Execution (CVE-2021-40444)

2021-09-09T00:00:00
trendmicroblog
blog

FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal

2021-09-29T00:00:00
trendmicroblog
blog

Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

2021-09-09T00:00:00
trendmicroblog
blog

Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited

2021-12-13T00:00:00
malwarebytes
blog

MSHTML attack targets Russian state rocket centre and interior ministry

2021-09-22T19:16:56
malwarebytes
blog

Meet Exotic Lily, access broker for ransomware and other malware peddlers

2022-03-18T22:58:48
malwarebytes
blog

[updated] Windows MSHTML zero-day actively exploited, mitigations required

2021-09-08T11:04:07
malwarebytes
blog

New spear phishing campaign targets Russian dissidents

2022-03-29T18:02:48
cisa
info

Microsoft Releases Mitigations and Workarounds for CVE-2021-40444

2021-09-07T00:00:00
cisa
info

Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems

2022-06-23T00:00:00
cisa_kev
info

Microsoft MSHTML Remote Code Execution Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Apache Log4j2 Remote Code Execution Vulnerability

2021-12-10T00:00:00
prion
NVD

CVE-2021-40444

2021-09-15T12:15:00
kaspersky
info

KLA12278 RCE vulnerability in Microsoft Products (ESU)

2021-09-07T00:00:00
kaspersky
info

KLA12277 RCE vulnerability in Microsoft Windows

2021-09-07T00:00:00
hivepro
info

New Threat Actor Exotic Lily acting as Initial Access Broker for Conti and Diavol ransomware group

2022-03-21T05:34:00
hivepro
info

Iranian hackers leveraged Log4Shell to penetrate US federal agency

2022-11-17T12:28:57
mssecure
blog

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

2021-09-15T23:40:56
mssecure
blog

MERCURY and DEV-1084: Destructive attack on hybrid environment

2023-04-07T16:00:00
cnvd
cnvd

Microsoft MSHTML Remote Code Execution Vulnerability

2021-09-08T00:00:00
attackerkb
info

CVE-2021-40444

2021-09-15T00:00:00
attackerkb
info

CVE-2022-30190

2022-06-02T00:00:00
nessus
scanner

Security Updates for Microsoft Internet Explorer OOB (Sept 2021) (deprecated)

2021-09-10T00:00:00
nessus
scanner

Security Updates for Internet Explorer (September 2021)

2021-09-14T00:00:00
nessus
scanner

Cisco SD-WAN vManage Log4j Remote Code Execution (cisco-sa-apache-log4j-qRuKNEbd)

2022-05-16T00:00:00
nessus
scanner

FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)

2021-12-13T00:00:00
nessus
scanner

FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)

2021-12-13T00:00:00
cve
NVD

CVE-2021-40444

2021-09-15T12:15:00
mskb
microsoft

KB5005563: Cumulative security update for Internet Explorer: September 14, 2021

2021-09-07T07:00:00
avleonov
blog

PHDays 11: towards the Independence Era

2022-06-11T00:46:58
mscve
microsoft

Microsoft MSHTML Remote Code Execution Vulnerability

2021-09-07T07:00:00
securelist
blog

Exploitation of the CVE-2021-40444 vulnerability in MSHTML

2021-09-16T15:30:57
packetstorm
exploit

Microsoft Office Word MSHTML Remote Code Execution

2021-12-09T00:00:00
packetstorm
exploit

Intel Data Center Manager 5.1 Local Privilege Escalation

2022-12-09T00:00:00
packetstorm
exploit

Log4Shell HTTP Header Injection

2022-01-12T00:00:00
kitploit
tools

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)

2021-09-16T13:13:00
krebs
blog

Microsoft: Attackers Exploiting Windows Zero-Day Flaw

2021-09-08T15:03:45
pentestpartners
blog

Follina 0day exploit. Malicious code execution in Office docs

2022-06-01T05:38:30
ibm
software

Security Bulletin: IBM Insurance Information Warehouse is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

2021-12-30T18:32:37
ibm
software

Security Bulletin: Vulnerability in Apache Log4j affects IBM Data Risk Manager (CVE-2021-44228)

2021-12-16T04:28:35
ibm
software

Security Bulletin: Vulnerablity in Apache Log4j affects IBM Tivoli Composite Application Manager for Application Diagnostics (CVE-2021-44228)

2022-03-15T01:17:21
ibm
software

Security Bulletin: Vulnerabilitiy in Apache Log4jaffects IBM Observability with Instana - Server and Agents (CVE-2021-44228)

2022-01-11T20:10:06
ibm
software

Security Bulletin: IBM Security Directory Integrator NOT Affected by CVE-2021-44228 Exploit

2021-12-16T04:19:55
ibm
software

Security Bulletin: Apache Log4j vulnerability impacts IBM Watson Knowledge Catalog in Cloud Pak for Data (CVE-2021-44228)

2022-03-21T11:39:47
ibm
software

Security Bulletin: Vulnerability in Apache Log4j2 affects IBM Spectrum LSF. (CVE-2021-44228)

2021-12-17T05:25:57
ibm
software

Security Bulletin: Apache Log4j vulnerability is affecting IBM Engineering Requirements Management DOORS

2021-12-16T21:13:54
ibm
software

Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerability(CVE-2021-44228)

2022-01-10T06:18:22
ibm
software

Security Bulletin: IBM Netcool Agile Service Manager is affected by a vulnerability in Apache Log4j (CVE-2021-44228)

2021-12-23T18:45:10
ibm
software

Security Bulletin: Log4j as used in IBM® Disconnected Log Collector is vulnerable to remote code execution (RCE) (CVE-2021-44228)

2021-12-17T20:00:24
ibm
software

Security Bulletin: IBM Maximo Application Suite is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

2022-02-23T18:56:25
ibm
software

Security Bulletin: Log4j Vulnerability ( CVE-2021-44228 ) in IBM Informix Dynamic Server in Cloud Pak for Data

2021-12-21T16:32:25
ibm
software

Security Bulletin: Log4JShell Vulnerability affects Watson Knowledge Catalog InstaScan (CVE-2021-44228)

2021-12-17T04:55:42
ibm
software

Security Bulletin: Vulnerability exists in Watson Explorer (CVE-2021-44228)

2021-12-16T13:28:20
ibm
software

Security Bulletin: Apache Log4j Vulnerability Affects IBM Sterling Control Center (CVE-2021-44228)

2021-12-17T18:27:06
ibm
software

Security Bulletin: The Apache Log4j (CVE-2021-44228) vulnerability affects z/TPF and TPF Operations Server

2021-12-20T20:53:23
ibm
software

Security Bulletin: A security vulnerability has been identified in Log4j 2 used in IBM Guardium Data Encryption (GDE) (CVE-2021-44228)

2021-12-20T04:50:43
ibm
software

Security Bulletin: Vulnerability in Apache Log4j affects some features of IBM DB2 supported by IBM Security Verify Governance

2022-04-29T05:35:36
ibm
software

Security Bulletin: IBM Security Verify Privilege Products NOT Affected by CVE-2021-44228 Exploit

2021-12-13T13:37:26
ibm
software

Security Bulletin: IBM OpenPages with Watson has addressed security vulnerability in Apache Log4j (CVE-2021-44228)

2021-12-17T13:26:41
ibm
software

Security Bulletin: Cloudera Data Platform is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

2022-01-17T14:19:15
ibm
software

Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches.

2021-12-20T21:32:08
msrc
blog

CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応

2021-12-12T08:00:00
msrc
blog

Microsoft’s Response to CVE-2021-44228 Apache Log4j 2

2021-12-12T05:28:18
akamaiblog
blog

Threat Intelligence on Log4j CVE: Key Findings and Their Implications

2021-12-17T19:30:00
osv
software

Critical vulnerability in log4j may affect generated PEAR projects

2021-12-16T21:01:51
redhat
unix

(RHSA-2021:5093) Critical: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update

2021-12-14T15:57:34
redhat
unix

(RHSA-2021:5130) Critical: Red Hat Integration Camel-K 1.6.2 release and security update

2021-12-14T17:51:25
redhat
unix

(RHSA-2021:5126) Critical: Red Hat Integration Camel Extensions for Quarkus GA security update

2021-12-14T16:15:45
fedora
unix

[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34

2021-12-22T01:14:26
wallarmlab
blog

Update on Log4Shell (CVE-2021-44228)

2021-12-10T20:22:36
hackerone
bugbounty

U.S. Dept Of Defense: ██████████ running a vulnerable log4j

2021-12-11T00:16:38
hackerone
bugbounty

U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j

2021-12-31T00:55:49
impervablog
blog

Analytics Are Essential for Effective Database Security

2022-01-13T15:23:02