The numbers behind a cyber pandemic - detailed dive

Precisely one year after the SolarWinds Hack, the groundbreaking supply chain attack the world experienced, and while organizations are still struggling to protect the software supply chain from third-party risk, the Apache Log4j vulnerability exploit has caught security teams during a weekend. Unlike other major cyber-attacks that involve one or a limited number of software, Log4j is basically embedded in every Java based product or web service. It is very difficult to manually remediate it. Once an exploration was published (on Friday), scans of the internet ensued (to allocate surfaces which are vulnerable due to this incident). Those who won’t implement a protection are probably already scanned by malicious actors.

Since Friday, December 9^th, when the vulnerability was reported, actors around the world are on the lookout for exploits. The number of combinations of how to exploit it give the attacker many alternatives to bypass newly introduced protections. It means that one layer of protection is not enough, and only multi-layered security posture would provide a resilient protection. Three days after the outbreak, we are summing up what we see until now, which is clearly a cyber pandemic that hasn’t seen its peak yet.

Current:

• At some points, Check Point Research (CPR) is seeing over 100 hacks a minute related to LogJ4

• CPR has documented over 846,000 attacks, 72 hours after initial outbreak
• 46% of those attempts were made by known malicious groups
• Over 40% of corporate networks globally have been targeted
• CPR has witnessed over 60 new variations introduced of the original exploit, in less than 24 hours.

Timeline:

• Twenty-four hours after the initial outbreak our sensors recorded almost 200,000 attempts of attack across the globe leveraging the vulnerability
• CPR has documented over 846,000 attacks, 72 hours after initial outbreak

Spread by Region

Figure 1. % of Corp networks impacted per region

Figure 2. % of corporate networks exploited by region and date

Quote: Lotem Finkelstein, Head of Threat Intelligence at Check Point Software

“This is clearly one of the most serious vulnerabilities on the internet in recent years, and it’s spreading like wild fire. At one point, we saw over 100 hacks a minute related to the LogJ4 vulnerability. We’re seeing what appears to be an evolutionary repression, with new variations of the original exploit being introduced rapidly - over 60 in less than 24 hours. The number of combinations of how to exploit it gives the attacker many alternatives to bypass newly introduced protections. It means that one layer of protection is not enough, and only multi layered security posture would provide a resilient protection.

Unlike other major cyber attacks that involve one or limited number of software, Log4j is basically embedded in every Java based product or web service. It is very difficult to manually remediate it . Once an exploration was published (on Friday), scans of the internet ensued (to allocate surfaces which are vulnerable due to this incident). Those who won’t implement a protection are probably already scanned by malicious actors. Already, we’ve documented over 846,000 attacks, where over 40% of corporate networks globally have been targeted.

This vulnerability, because of the complexity in patching it and easiness to exploit, will stay with us for years to come, unless companies and services take immediate action to prevent the attacks on their products by implementing a protection. Now is the time to act. Given the holidays seasons, when security teams may be slower to implement protective measure, the threat is imminent. This acts like a cyber pandemic — highly contagious, spreads rapidly and has multiple variants, which force more ways to attack.”