Log4Shell Global Exploitation
Mass exploitation of the Log4j remote code execution vulnerability (CVE-2021-44228) starting December 2021 — one of the fastest and widest exploitation windows ever recorded.
Log4Shell (CVE-2021-44228) is an unauthenticated remote code execution flaw in Apache Log4j 2 that was exploited at global scale within days of disclosure in December 2021, across internet-facing Java applications and later across enterprise and ICS environments.
Definition
Mass exploitation campaign centered on Apache Log4j 2 JNDI injection (CVE-2021-44228 and follow-ups CVE-2021-45046) that let attackers load remote code via crafted log messages, triggering second-stage payloads from coin miners to ransomware.
Why It Matters / Impact
Virtually every Java-based application stack was exposed; CISA added CVE-2021-44228 to KEV within days; exploitation spanned cloud services, enterprise apps and OT/ICS devices globally.
Current Status
- Review status: published
- Last updated: 2026-08-26
- Evidence: 3 source(s) · 2 CVE(s) linked
- Confidence: 95%
Related CVEs
EvidenceRelated Malware
Timeline
- 2021-12-09 — CVE-2021-44228 disclosed in Apache Log4j 2.14.1 and earlier
- 2021-12-10 — First in-the-wild activity reported within hours
- 2021-12-17 — CISA releases Emergency Directive 22-02; Log4j 2.17.0 stable
Sources
Start Investigation
Move from reading to investigating Log4Shell Global Exploitation. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about Log4Shell Global Exploitation?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- IOC LookupSearch OpenTrojan intelligence for indicators tied to this campaign.Look up IOC
Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →