Ukraine's State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
Source AlienVault OTX General
Ukraine- ukraine targeting
- x-road platform
- state infrastructure
- graylog
- deserialization
- jndi exploitation
- uxp verifier
- log4shell
Mentions 3 CVEs
Mentioned vulnerabilities
Description
Between May and September 2026, a Russian-speaking threat actor targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker scanned millions of Ukrainian IP addresses to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 deserialization exploit delivered via Graylog's sessions API, the attacker gained access to at least two organizations, including a logging server containing millions of documents. The operation was exposed when the attacker accidentally served their working directory over HTTP, revealing tools and logs. Although the attacker queried transaction indices and showed knowledge of the system schema, no direct data exfiltration was observed. The campaign also involved failed exploitation attempts of other vulnerabilities.
Impact
The attacker gained unauthorized access to critical components of Ukraine's state data-exchange infrastructure, including a logging server containing millions of documents. This access could have enabled reconnaissance and potential manipulation of sensitive state data. However, no direct evidence of data exfiltration was observed. The exposure of attacker tools and logs provides valuable intelligence for defensive measures. The campaign demonstrates the risk posed by Log4Shell and related vulnerabilities in critical infrastructure systems.
Defensive guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using Graylog servers should verify that all known Log4Shell (CVE-2021-44228) and related vulnerabilities (such as CVE-2021-41987 and CVE-2018-14847) are fully patched. Given the critical nature of the exploited vulnerabilities, immediate application of official vendor patches or mitigations is recommended. Additionally, monitoring for suspicious activity related to Graylog sessions API and deserialization exploits is advised.
Indicators of compromise
Domains 1
- scanitex.com
IP addresses 2
- 85.239.144.170
- 31.77.220.141
Hashes 7
CVEs 2
- CVE-2018-14847
- CVE-2021-41987