FritzFrog Botnet Exploits Log4Shell on Overlooked Internal Hosts

Executive Summary: A new FritzFrog botnet variant is actively spreading by brute-forcing SSH credentials and exploiting Log4Shell to pivot inside internal networks; it also abuses CVE-2021-4034 for privilege escalation and employs RAM-only techniques (memfd_create, /dev/shm), Tor, and antivirus-killing for stealth—the campaign has been associated with over 20,000 attacks against roughly 1,500 victims and can be mitigated by patching and stronger credentials.