Loading story…
Attackers exploited the Spring4Shell remote code execution flaw, tracked as CVE-2022-22965, to gain code execution on vulnerable Spring Framework applications and deploy Mirai botnet malware. Reporting from Trend Micro showed the vulnerability being weaponized shortly after disclosure, with exploitation attempts targeting exposed Java applications that met the conditions for the flaw.
The observed activity linked a high-profile enterprise software vulnerability to commodity botnet operations, demonstrating how internet-facing servers can be rapidly folded into malware infrastructure after public disclosure. In the documented attacks, successful exploitation led to execution of Mirai-related payloads on compromised systems, underscoring the risk of unpatched Spring deployments being used for botnet propagation and follow-on malicious activity.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research analyzing exploitation of CVE-2022-22965 (Spring4Shell), including its use to weaponize and execute Mirai botnet malware. The publication indicates technical details of active abuse and attacker tradecraft were publicly documented by this date.
Netlab 360 published observations from its honeypots showing exploitation activity targeting Spring4Shell shortly after the advisory. The report publicly documented early in-the-wild abuse before later analyses such as Trend Micro's April 8 write-up.
Zscaler ThreatLabz published analysis of active exploitation of Log4Shell (CVE-2021-44228), describing delivery of Mirai, Kinsing, AWS credential theft, and a Windows Monero miner, along with infrastructure and detection signatures. The report publicly documented technical details and indicators tied to in-the-wild abuse of the vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 396 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcethehackernews.com
Open sourcetrendmicro.com
Open sourceblog.netlab.360.com
Open sourcecybersecurity.att.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers began exploiting the Spring Framework remote code execution flaw **Spring4Shell** (`CVE-2022-22965`) to plant JSP web shells on vulnerable Apache Tomcat servers and deliver cryptocurrency miners. Trend Micro reported attempts that wrote a web shell named `zbc0fb.jsp` into the Tomcat web root, then used it to run operating-system-specific payloads on both Windows and Linux systems. The activity followed Spring's disclosure of the RCE issue and its guidance to upgrade to fixed releases, including **Spring Framework 5.3.18** and **5.2.20** or later. On Windows targets, the observed chain used hidden PowerShell execution to fetch `ldr.ps1` in memory, which then downloaded a miner from `194.145.227.21`. The miner was designed to disable the firewall, kill competing miner processes and services bound to common mining ports, launch the payload, and establish persistence through a scheduled task named **BrowserUpdate** and a Windows Run key. The intrusion pattern mirrors earlier enterprise-server exploitation seen in incidents such as **WebLogic RCE leading to XMRig**, underscoring how rapidly newly disclosed Java server flaws are weaponized for opportunistic cryptomining.
Aug 26, 2026
A newly disclosed vulnerability dubbed **Spring4Shell** or **SpringShell** affects certain Spring-based Java applications and could allow remote code execution under specific conditions. Reported prerequisites include use of the `spring-beans` library, **Java 9+**, and **Tomcat 9+**; successful exploitation may let an attacker write a malicious payload to disk for later execution. Public proof-of-concept code was released, increasing the risk of opportunistic testing against exposed systems. The reporting distinguishes Spring4Shell from **`CVE-2022-22963`**, which affects **Spring Cloud Function** and is described as a separate issue rather than the same flaw. At the time covered by the references, there were no official reports of active exploitation in the wild and no official patch yet available, but defenders were provided public mitigation guidance and **YARA** detection rules to help identify vulnerable deployments and possible exploitation attempts.
Jul 16, 2026
Two critical vulnerabilities in the Spring ecosystem exposed Java applications to remote code execution: **CVE-2022-22965** in the Spring Framework, widely known as **Spring4Shell**, and **CVE-2022-22963** in **Spring Cloud Function**. Spring4Shell abuses the framework’s data-binding mechanism under specific conditions—including **JDK 9+**, **Apache Tomcat**, vulnerable Spring Framework versions, and **WAR** deployment—to let attackers overwrite Tomcat logging configuration and drop a **JSP web shell** on the server. The Spring Cloud Function issue, **CVE-2022-22963**, allows code injection through a crafted `spring.cloud.function.routing-expression` HTTP header that exploits **Spring Expression Language (SpEL)** to achieve remote code execution. Vendor and security reporting identified affected versions, published fixes and mitigations, and highlighted detection opportunities including exploit-related file hashes and generic security verdicts for spotting attempted compromise.
Sep 3, 2026