Log4J – A Look into Threat Actors Exploitation Attempts

On December 9 a critical zero-day in Apache Log4j (Log4Shell, CVE-2021-44228; CVSS 10) was disclosed and rapidly weaponized: public PoCs enabled widespread scanning, exploit attempts across many HTTP headers, sinkholing of successful probes, syntactic bypasses, and real-world exploitation that dropped an XMRig cryptominer. The report provides example payloads, describes scanner and attacker behaviors, and documents Cato Networks' rapid mitigation and detection rollout.