The terrible Log4j bug mayhem goes on as the Belgium Defense Ministry has emerged as the latest victim. It appears that the attack has occurred through state-sponsored threat actors who are actively exploiting the vulnerable Log4j.
Belgium Defense Ministry Hacked Via Log4j Exploit
According to local media reports, the Belgian Defense Ministry has suffered a cyberattack recently.
The official statements detailing the exact cause of the attack and incident timelines are yet to arrive. However, reports suggest that the hackers may have exploited the recently discovered Log4j vulnerability to target Belgium Defense Ministry.
Regarding the incident, Olivier Severin, Belgium MoD spokesperson, told in a statement to the media,
All weekend our teams have been mobilized to control the problem, continue our activities and warn our partners… The priority is to keep the network operational. We will continue to monitor the situation.
But he declined to comment any further on this matter.
Defense will not provide any further information at this stage.
The critical Log4j vulnerability “Log4Shell” surfaced online about a week ago. While Apache rushed to patch the bug, the hurried measures didn’t suffice to secure the internet. Hence, the threat actors quickly started exploiting the bug on unpatched systems globally.
The risk further increased as Apache had to release Log4j updates thrice before reaching the fix. Therefore, the latest version that Log4j users should have on their systems is version 2.17.0.
Nonetheless, it isn’t an excuse for leaving systems vulnerable since the cybersecurity community worked equally well in mitigating the bug. Researchers even rolled out a “vaccine” to disable the vulnerable configurations until the users could receive a patch.
Thus, it sounds odd that a sensitive entity like the Ministry of Defense misses updating its systems despite repeated alerts. Even the Centre for Cybersecurity Belgium had also issued a notification in this regard. Perhaps, things might become clear on how the incident happened after an official statement.
On a side note, all Log4j users should once again check their systems to ensure they received the updates.