Ukraine Data Exchange Breach Linked to Log4Shell
A five-year-old software vulnerability recently compromised servers associated with the Ukrainian state data exchange infrastructure. Specifically, an unidentified adversary leveraged the critical Log4Shell flaw within the Graylog log management platform. Consequently, the intruder achieved unauthorized command execution across at least two operational servers. One compromised host accommodated an Elasticsearch cluster containing over 6.8 million state records. Fortunately, forensic analysts have not observed evidence of large-scale data exfiltration.
Reconnaissance and Exploitation of the UXP Platform
Threat intelligence firm Hunt.io revealed extensive details of the intrusion campaign, which spanned from May through September 2026. According to the Hunt.io threat intelligence analysis of the Ukraine data exchange breach, the attacker scanned 9.1 million IP addresses across 2,874 autonomous network ranges. Specifically, the adversary sought exposed systems displaying a UXP Verifier interface. Public institutions rely on this specialized portal to exchange encrypted messages securely.
To breach the perimeter, the attacker targeted CVE-2021-44228, the notorious Log4Shell vulnerability in Apache Log4j. This defect carries a maximum CVSS rating of 10.0. In this campaign, the attacker injected malicious JNDI payloads directly into the username field of the Graylog session management API.
Payload Delivery and Remote Shell Access
Subsequently, the intrusion progressed through a two-stage delivery mechanism utilizing the CommonsBeanutils2 gadget chain. First, the vulnerable server retrieved an external shell script from remote infrastructure. Next, the host executed the script to establish an active reverse network connection. Telemetry logs confirm that the target server pulled the malicious payload just six seconds after the exploit executed. Later, on August 24, investigators detected identical staging activity on a second government server.
Probing Elasticsearch Clusters and Establishing Tunnels
Once inside the logging infrastructure, the adversary systematically audited the resident Elasticsearch databases. Notably, one targeted index contained 6,833,058 documents. The attacker issued structured queries targeting messaging participants, service definitions, user identifiers, and transaction outcomes. Consequently, this precise querying sequence demonstrates a thorough familiarity with internal database structures. Nevertheless, forensic evidence indicates that the threat actor gathered aggregate metrics rather than downloading raw documents.
Approximately 46 minutes after running the initial script, the server received private SSH keys to construct an encrypted network tunnel. Furthermore, the actor configured port forwarding on port 4000 to interact with UXP administrative services. However, investigators have not established whether the intruder successfully routed traffic through these secondary conduits.
Operational Blunders Expose the Intrusion Infrastructure
Ironically, the adversary exposed the entire operation through severe operational security failures. The attacker left a staging directory publicly accessible on their hosting server for 17 continuous hours. During this exposure window, 224 external IP addresses submitted over 15,000 web requests to the directory.
Consequently, third-party crawlers downloaded the attacker’s toolkits, scan logs, and private cryptographic keys before security teams intervened. Hunt.io preserved 193 intelligence files from the open directory, including terminal command histories. Furthermore, analysis revealed that the threat actor relied almost entirely on open-source exploit repositories. Hunt.io promptly shared technical artifacts with national computer emergency response teams to notify affected government stakeholders.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
