The Log4j flaw hasn't led to massive hacking attacks. But that doesn't mean the threat is over

Log4Shell affected hundreds of millions of devices and was cast as a critical tech emergency that would almost certainly be exploited attackers around the globe. 

But a month after the Apache Software Foundation disclosed Log4Shell in its Log4J library on December 9, the US Cybersecurity and Infrastructure Security Agency (CISA) said it hasn’t seen any major breach arise from the attack, with the exception of an attack on the Belgian Defense Ministry. 

more Log4j

The reason for the initial concern was that the Java-based application error logging component was embedded in so many in-house enterprise applications and hundreds of products from VMWare, Oracle, IBM, Cisco and others.

SEE: A winning strategy for cybersecurity (ZDNet special report)

Despite this, exploits using the vulnerability have been limited. For example, security firm Rapid7 saw a surge in exploit attempts against VMWare’s Horizon servers and Microsoft also observed a China-based double extortion ransomware gang NightSky targeting vulnerable instances of Horizon.  

Despite the absence of immediate mass exploitation, Sophos security’s Chester Wisniewski backs the view that it will be a target for exploitation for years to come. 

Microsoft continues to rate the Log4j vulnerabilities as a “high-risk situation” for companies across the globe and

Read More: