8220 Gang Uses Log4Shell Vulnerability to Install CoinMiner

Ahnlab Security Emergency response Center (ASEC) has recently confirmed that the 8220 Gang attack group is using the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers. Among the systems targeted for the attack, there were Korean energy-related companies with unpatched and vulnerable systems, hence being preyed upon by multiple attackers.

Log4Shell (CVE-2021-44228) is both a remote code execution vulnerability and the Java-based logging utility Log4j vulnerability that can remotely execute a Java object in servers that use Log4j by …

8220 gang address ahnlab asec attack attackers center code code execution coinminer companies cve cve-2021-44228 emergency energy horizon install java log log4j log4j vulnerability log4shell log4shell vulnerability logging malware analysis message object remote code remote code execution response security servers systems unpatched utility vmware vmware horizon vulnerability vulnerable