Security News > 2022 > April > Microsoft detects Spring4Shell attacks across its cloud services
Microsoft said that it's currently tracking a "Low volume of exploit attempts" targeting the critical Spring4Shell remote code execution vulnerability across its cloud services.
The Spring4Shell vulnerability impacts the Spring Framework, described as the "Most widely used lightweight open-source framework for Java.".
"Microsoft regularly monitors attacks against our cloud infrastructure and services to defend them better," the Microsoft 365 Defender Threat Intelligence Team said.
"Since the Spring Core vulnerability was announced, we have been tracking a low volume of exploit attempts across our cloud services for Spring Cloud and Spring Core vulnerabilities."
Microsoft further explained in their Monday report that attackers could exploit this Spring Core security flaw by sending specially crafted queries to servers running the Spring Core framework to create web shells in the Tomcat root directory.
Microsoft's discovery of ongoing attacks deploying Spring4Shell exploits against its cloud infrastructure comes after the U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog.
News URL
Related news
- Russian hackers shift to cloud attacks, US and allies warn (source)
- Five Eyes Agencies Expose APT29's Evolving Cloud Attack Tactics (source)
- CISA warns of Microsoft Streaming bug exploited in malware attacks (source)
- DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack (source)
- New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT (source)
- Microsoft to shut down 50 cloud services for Russian businesses (source)
- 17,000+ Microsoft Exchange servers in Germany are vulnerable to attack, BSI warns (source)
- How much does cloud-based identity expand your attack surface? (source)
- Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)