Search: CVE-2021-44228

CVE-2021-44228 is a critical remote code execution vulnerability in Apache Log4j2. It arises because JNDI features in Log4j2 do not properly protect against attacker-controlled JNDI endpoints, enabling attackers to execute arbitrary code remotely. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

Between May and September 2026, a Russian-speaking threat actor targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker scanned millions of Ukrainian IP addresses to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 deserialization exploit delivered via Graylog's sessions API, the attacker gained access to at least two organizations, including a logging server containing millions of documents. The operation was exposed when the attacker accidentally served their working directory over HTTP, revealing tools and logs. Although the attacker queried transaction indices and showed knowledge of the system schema, no direct data exfiltration was observed. The campaign also involved failed exploitation attempts of other vulnerabilities.

Campaign#ukraine targeting#x-road platformUkraine