Day 10: where we are with log4j from honeypot’s perspective
<p>Our team spent great deal of effort on simulating different protocols, applications and vulnerabilities with our honeypot (Anglerfish and Apacket) system. When big event happens, we are always curious what we see from the honeypot side. Since log4j came to light 10 days ago, we have published two related blogs, <a href="__GHOST_URL__/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/">here</a> and <a href="__GHOST_URL__/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/">here</a>. And looks like more malware are jumping on the bandwagon, as of December 17, we have captured a total of 72,242 attacks launched by 2042 attack source IPs (250 in China and 1,792 abroad), with the source IPs involved in 54 countries, and 132 attack source IPs were found to have exploited the vulnerability to propagate 617 known malware md5s belonging to 30 malware families.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/12/image-33.png" class="kg-image" alt loading="lazy"></figure><p>The graph above shows the curve of the number of exploit attacks over time, which shows that the number of attack sessions rose rapidly in the next few days after the vulnerability was exposed. On December 18, the day with the highest number of attack sessions so fare, there were over 28,000 attack sessions in one day. starting on December 13, there were also combined attacks of this vulnerability with other vulnerabilities (Apache Flink, Hadoop, Apache Struts2 vulnerability, etc.).</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/12/image-31.png" class="kg-image" alt loading="lazy"></figure><p>The figure above shows the main attack source IPs, so far the No.1 is <strong>78.31.71.248</strong>(PDNS points to srv62134.dus4.dedicated.server-hosting.expert), accounting for about 9% of the overall IP attacks, and the other main attack source IPs are shown in the legend on the right.</p><p>In terms of spreading malware, we reported the first botnet(Muhstik) taking advantage of this at exactly 8:00 on December 11, the number of malware spreading increasing significantly over time after that.</p><!--kg-card-begin: markdown--><table>
<thead>
<tr>
<th>IPs</th>
<th>sessions with malware</th>
<th>md5s</th>
<th>malware families</th>
</tr>
</thead>
<tbody>
<tr>
<td>170.210.45.163</td>
<td>4,753</td>
<td>28</td>
<td>6</td>
</tr>
<tr>
<td>167.71.175.10</td>
<td>4,678</td>
<td>15</td>
<td>4</td>
</tr>
<tr>
<td>164.52.53.163</td>
<td>3,926</td>
<td>30</td>
<td>6</td>
</tr>
<tr>
<td>46.105.95.220</td>
<td>3,710</td>
<td>30</td>
<td>6</td>
</tr>
<tr>
<td>1.116.59.211</td>
<td>2,824</td>
<td>31</td>
<td>6</td>
</tr>
<tr>
<td>89.249.63.3</td>
<td>2,195</td>
<td>31</td>
<td>6</td>
</tr>
<tr>
<td>86.109.208.194</td>
<td>2,121</td>
<td>29</td>
<td>6</td>
</tr>
<tr>
<td>178.176.202.121</td>
<td>2,081</td>
<td>29</td>
<td>6</td>
</tr>
<tr>
<td>175.6.210.66</td>
<td>2,025</td>
<td>30</td>
<td>7</td>
</tr>
<tr>
<td>191.232.38.25</td>
<td>1,776</td>
<td>23</td>
<td>6</td>
</tr>
</tbody>
</table>
<!--kg-card-end: markdown--><p>The table above lists the 10 IPs that spread the most malware, as well as the number of malware md5s and the number of malware families spread by each IPs.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/12/image-28.png" class="kg-image" alt loading="lazy"></figure><p>When we break down the 1083 executable samples and Java bytecode according to their ssdeep values., we get a total of 107 groups of samples (mainly Java bytecode files), within which, 30 groups (correspondingly 617 malware md5s) can be identified as specific malware families, the rest of them are currently unknown.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/12/image-25.png" class="kg-image" alt loading="lazy"></figure><p>In terms of malware download servers, 34.221.40.237 is the most frequent download server, with nearly half of the malware coming from this download server. This is an AWS cloud server IP located in the U.S. Other common download servers are shown in the legend on the right side of the image above, and the table below lists the 10 download servers used by the attackers.</p><!--kg-card-begin: markdown--><table>
<thead>
<tr>
<th>download servers</th>
<th>attackers</th>
<th>malware md5s</th>
<th>malware families</th>
<th>sessions</th>
</tr>
</thead>
<tbody>
<tr>
<td>34.221.40.237</td>
<td>102</td>
<td>8</td>
<td>2</td>
<td>50,358</td>
</tr>
<tr>
<td>159.89.182.117</td>
<td>102</td>
<td>1</td>
<td>1</td>
<td>1,850</td>
</tr>
<tr>
<td>18.228.7.109</td>
<td>75</td>
<td>15</td>
<td>1</td>
<td>2,947</td>
</tr>
<tr>
<td>31.220.58.29</td>
<td>73</td>
<td>6</td>
<td>2</td>
<td>467</td>
</tr>
<tr>
<td>137.184.174.180</td>
<td>66</td>
<td>1</td>
<td>1</td>
<td>1,097</td>
</tr>
<tr>
<td>68.183.165.105</td>
<td>66</td>
<td>5</td>
<td>1</td>
<td>6,334</td>
</tr>
<tr>
<td>210.141.105.67</td>
<td>51</td>
<td>1</td>
<td>1</td>
<td>183</td>
</tr>
<tr>
<td>45.130.229.168</td>
<td>15</td>
<td>1</td>
<td>1</td>
<td>34</td>
</tr>
<tr>
<td>103.13.230.149</td>
<td>14</td>
<td>6</td>
<td>1</td>
<td>156</td>
</tr>
<tr>
<td>54.210.230.186</td>
<td>14</td>
<td>1</td>
<td>1</td>
<td>19</td>
</tr>
<tr>
<td>45.80.181.55</td>
<td>6</td>
<td>6</td>
<td>1</td>
<td>54</td>
</tr>
</tbody>
</table>
<!--kg-card-end: markdown--><p>Among the attack source IPs that can be traced, most of attackers come from Alpha Strike Labs (a German network security company). In addition to security vendors and research institutions, there are also a large number of attacks from Tor exit nodes.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/12/image-26.png" class="kg-image" alt loading="lazy"></figure><!--kg-card-begin: markdown--><h3 id="contactus">Contact us</h3>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> or email us to netlab at 360 dot cn.</p>
<!--kg-card-end: markdown-->
Our team spent great deal of effort on simulating different protocols, applications and vulnerabilities with our honeypot (Anglerfish and Apacket) system. When big event happens, we are always curious what we see from the honeypot side. Since log4j came to light 10 days ago, we have published two related blogs, here and here. And looks like more malware are jumping on the bandwagon, as of December 17, we have captured a total of 72,242 attacks launched by 2042 attack source IPs (250 in China and 1,792 abroad), with the source IPs involved in 54 countries, and 132 attack source IPs were found to have exploited the vulnerability to propagate 617 known malware md5s belonging to 30 malware families.

The graph above shows the curve of the number of exploit attacks over time, which shows that the number of attack sessions rose rapidly in the next few days after the vulnerability was exposed. On December 18, the day with the highest number of attack sessions so fare, there were over 28,000 attack sessions in one day. starting on December 13, there were also combined attacks of this vulnerability with other vulnerabilities (Apache Flink, Hadoop, Apache Struts2 vulnerability, etc.).

The figure above shows the main attack source IPs, so far the No.1 is 78.31.71.248(PDNS points to srv62134.dus4.dedicated.server-hosting.expert), accounting for about 9% of the overall IP attacks, and the other main attack source IPs are shown in the legend on the right.

In terms of spreading malware, we reported the first botnet(Muhstik) taking advantage of this at exactly 8:00 on December 11, the number of malware spreading increasing significantly over time after that.




IPs
sessions with malware
md5s
malware families




170.210.45.163
4,753
28
6


167.71.175.10
4,678
15
4


164.52.53.163
3,926
30
6


46.105.95.220
3,710
30
6


1.116.59.211
2,824
31
6


89.249.63.3
2,195
31
6


86.109.208.194
2,121
29
6


178.176.202.121
2,081
29
6


175.6.210.66
2,025
30
7


191.232.38.25
1,776
23
6





The table above lists the 10 IPs that spread the most malware, as well as the number of malware md5s and the number of malware families spread by each IPs.

When we break down the 1083 executable samples and Java bytecode according to their ssdeep values., we get a total of 107 groups of samples (mainly Java bytecode files), within which, 30 groups (correspondingly 617 malware md5s) can be identified as specific malware families, the rest of them are currently unknown.

In terms of malware download servers, 34.221.40.237 is the most frequent download server, with nearly half of the malware coming from this download server. This is an AWS cloud server IP located in the U.S. Other common download servers are shown in the legend on the right side of the image above, and the table below lists the 10 download servers used by the attackers.




download servers
attackers
malware md5s
malware families
sessions




34.221.40.237
102
8
2
50,358


159.89.182.117
102
1
1
1,850


18.228.7.109
75
15
1
2,947


31.220.58.29
73
6
2
467


137.184.174.180
66
1
1
1,097


68.183.165.105
66
5
1
6,334


210.141.105.67
51
1
1
183


45.130.229.168
15
1
1
34


103.13.230.149
14
6
1
156


54.210.230.186
14
1
1
19


45.80.181.55
6
6
1
54





Among the attack source IPs that can be traced, most of attackers come from Alpha Strike Labs (a German network security company). In addition to security vendors and research institutions, there are also a large number of attacks from Tor exit nodes.


Contact us


Readers are always welcomed to reach us on twitter or email us to netlab at 360 dot cn.

{"version":"0.3.1","atoms":[],"cards":[["image",{"src":"__GHOST_URL__/content/images/2021/12/image-33.png"}],["image",{"src":"__GHOST_URL__/content/images/2021/12/image-31.png"}],["markdown",{"markdown":"| IPs | sessions with malware | md5s | malware families |\n| --------------- | ------------------ | ----------- | ------------ |\n| 170.210.45.163  | 4,753              | 28          | 6            |\n| 167.71.175.10   | 4,678              | 15          | 4            |\n| 164.52.53.163   | 3,926              | 30          | 6            |\n| 46.105.95.220   | 3,710              | 30          | 6            |\n| 1.116.59.211    | 2,824              | 31          | 6            |\n| 89.249.63.3     | 2,195              | 31          | 6            |\n| 86.109.208.194  | 2,121              | 29          | 6            |\n| 178.176.202.121 | 2,081              | 29          | 6            |\n| 175.6.210.66    | 2,025              | 30          | 7            |\n| 191.232.38.25   | 1,776              | 23          | 6            |"}],["image",{"src":"__GHOST_URL__/content/images/2021/12/image-28.png"}],["image",{"src":"__GHOST_URL__/content/images/2021/12/image-25.png"}],["markdown",{"markdown":"| download servers | attackers | malware md5s | malware families | sessions |\n| --------------- | ------------ | ------------ | ------------ | ------------ |\n| 34.221.40.237   | 102          | 8            | 2            | 50,358       |\n| 159.89.182.117  | 102          | 1            | 1            | 1,850        |\n| 18.228.7.109    | 75           | 15           | 1            | 2,947        |\n| 31.220.58.29    | 73           | 6            | 2            | 467          |\n| 137.184.174.180 | 66           | 1            | 1            | 1,097        |\n| 68.183.165.105  | 66           | 5            | 1            | 6,334        |\n| 210.141.105.67  | 51           | 1            | 1            | 183          |\n| 45.130.229.168  | 15           | 1            | 1            | 34           |\n| 103.13.230.149  | 14           | 6            | 1            | 156          |\n| 54.210.230.186  | 14           | 1            | 1            | 19           |\n| 45.80.181.55    | 6            | 6            | 1            | 54           |"}],["image",{"src":"__GHOST_URL__/content/images/2021/12/image-26.png"}],["markdown",{"markdown":"### Contact us\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab) or email us to netlab at 360 dot cn."}]],"markups":[["a",["href","__GHOST_URL__/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/"]],["a",["href","__GHOST_URL__/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/"]],["strong"]],"sections":[[1,"p",[[0,[],0,"Our team spent great deal of effort on simulating different protocols, applications and vulnerabilities with our honeypot (Anglerfish and Apacket) system. When big event happens, we are always curious what we see from the honeypot side. Since log4j came to light 10 days ago, we have published two related blogs, "],[0,[0],1,"here"],[0,[],0," and "],[0,[1],1,"here"],[0,[],0,". And looks like more malware are jumping on the bandwagon, as of December 17, we have captured a total of 72,242 attacks launched by 2042 attack source IPs (250 in China and 1,792 abroad), with the source IPs involved in 54 countries, and 132 attack source IPs were found to have exploited the vulnerability to propagate 617 known malware md5s belonging to 30 malware families."]]],[10,0],[1,"p",[[0,[],0,"The graph above shows the curve of the number of exploit attacks over time, which shows that the number of attack sessions rose rapidly in the next few days after the vulnerability was exposed. On December 18, the day with the highest number of attack sessions so fare, there were over 28,000 attack sessions in one day. starting on December 13, there were also combined attacks of this vulnerability with other vulnerabilities (Apache Flink, Hadoop, Apache Struts2 vulnerability, etc.)."]]],[10,1],[1,"p",[[0,[],0,"The figure above shows the main attack source IPs, so far the No.1 is "],[0,[2],1,"78.31.71.248"],[0,[],0,"(PDNS points to srv62134.dus4.dedicated.server-hosting.expert), accounting for about 9% of the overall IP attacks, and the other main attack source IPs are shown in the legend on the right."]]],[1,"p",[[0,[],0,"In terms of spreading malware, we reported the first botnet(Muhstik) taking advantage of this at exactly 8:00 on December 11, the number of malware spreading increasing significantly over time after that."]]],[10,2],[1,"p",[[0,[],0,"The table above lists the 10 IPs that spread the most malware, as well as the number of malware md5s and the number of malware families spread by each IPs."]]],[10,3],[1,"p",[[0,[],0,"When we break down the 1083 executable samples and Java bytecode according to their ssdeep values., we get a total of 107 groups of samples (mainly Java bytecode files), within which, 30 groups (correspondingly 617 malware md5s) can be identified as specific malware families, the rest of them are currently unknown."]]],[10,4],[1,"p",[[0,[],0,"In terms of malware download servers, 34.221.40.237 is the most frequent download server, with nearly half of the malware coming from this download server. This is an AWS cloud server IP located in the U.S. Other common download servers are shown in the legend on the right side of the image above, and the table below lists the 10 download servers used by the attackers."]]],[10,5],[1,"p",[[0,[],0,"Among the attack source IPs that can be traced, most of attackers come from Alpha Strike Labs (a German network security company). In addition to security vendors and research institutions, there are also a large number of attacks from Tor exit nodes."]]],[10,6],[10,7],[1,"p",[]]],"ghostVersion":"3.0"}