Cybersecurity companies are experiencing millions of attempts to exploit the recently discovered Log4j vulnerability, but CISA says the agency hasn’t received many reports of attacks using the flaw. CISA director Jen Easterly concedes that the agency isn’t sure yet whether that’s because of effective early mitigation, or because malicious actors are being patient with the new access they’ve acquired to unpatched systems. Easterly noted that the infamous Equifax breach discovered in September 2017 took advantage of a bug found six months earlier, also in a widely used open-source software package. CISA has identified more than 2,800 commercial products that use the Log4j tool, and Easterly describes the vulnerability as both the most severe she’s seen and “pretty trivial” to exploit.
Source: