Research Details Graylog Log4Shell Activity Against Ukrainian Data-Exchange Systems

Oct 20, 2026 · Original article ↗

Summary

Hunt.io researchers traced a Russian-speaking operator’s Graylog Log4Shell activity against Ukrainian organizations, documenting execution on at least two hosts and no observed exfiltration from one data-exchange logging cluster. The operator was not attributed to a

Key points

From May to September 2026, the operator scanned Ukrainian address ranges and filtered hosts for the “UXP Verifier” page associated with a state data-exchange platform.
A two-stage CommonsBeanutils2 deserialization chain sent through Graylog’s sessions API caused targets to fetch a shell stager; records support execution on at least two hosts, but do not directly confirm interactive shell sessions.
The operator’s staging directory was publicly accessible for 17 hours. Its access log and working files provided evidence of the campaign and target activity.
On one Graylog cluster, the operator queried an index containing 6,833,058 documents and retrieved aggregate counts. Researchers observed no exfiltration from that cluster, while noting this does not prove none occurred.
The report identifies a defensive signal: a POST to /api/system/sessions with a JNDI string in the username and the X-Requested-By: cli header; a child process spawned from the Java service is another relevant indicator.
Researchers did not attribute the activity to a tracked actor. They assessed the operator’s objective as collection with medium confidence.

Article Details

Attack Vectors: The operator scanned Ukrainian IP ranges for port 5000, then filtered HTTPS responses for the string “UXP Verifier” to identify data-exchange participants.
A two-stage CommonsBeanutils2 deserialization chain sent a JNDI string to Graylog’s /api/system/sessions endpoint. The first stage made the target fetch a shell stager; the second executed it to open a reverse shell. Stager retrieval was observed on two hosts, but an interactive shell was not directly confirmed on the fully documented host.
The operator scanned for CVE-2018-14847 and attempted original exploit research against CVE-2021-41987; no completed RouterOS exploit chain was recovered.
Using an ASP.NET session of unknown origin, the operator attempted SQL injection, XXE, and webshell uploads against a hotel management platform; none of these attempts is reported as successful.
On an earlier target, a script opened an SSH tunnel to the host and forwarded port 4000, the UXP management interface. The capture does not show what traffic crossed the tunnel.
Defensive Notes: Hunt for POST requests to /api/system/sessions with a ${jndi: substring in the username field and the X-Requested-By: cli header.
On Graylog hosts, investigate child processes spawned by the Java service; the payload command executes during class initialization and may evade rules focused on application-logic Runtime.exec call sites.
Search payload content for ysoserial/payloads/util/Gadgets$StubTransletPayload, which the article identifies as stable across payloads built this way.
The article identifies staging on port 8888 alongside JNDI listener port 1389 and HTTP listener port 8890 as operator infrastructure; it also notes that the 8890 listener was configured but not contacted.
Use staging-server access logs to hunt for target stager retrieval; the JNDI listener log showed unrelated scanner noise in the documented case.
Search exposed services for the UXP Verifier page title to assess deployment exposure in a region.

Indicators of compromise

Type	Indicator	Context
EMAIL	`pentest01@proton[.]me`	Account attributed to the operator and used on a hotel platform’s chat services.
IPV4	`31[.]77[.]220[.]141`	Confirmed operator staging server that hosted the payload, keypair, and working directory.
IPV4	`85[.]239[.]144[.]170`	Confirmed earlier operator staging server that hosted exploit scripts, a JNDI listener, and a stager used against another target.
SHA256	`40103a4ae0abbef8f35a7adce7f50a9f536198a850b6eeb9761d6470d1fffa9e`	Hash of cb2/s1.ser, a serialized object used in the operator’s two-stage payload.
SHA256	`6dde072a64933967456a57610dce8978dab195f9f9de66a0ecd1b1c7bfacacae`	Hash of cb2/MakeCB2.class, the compiled Java class used to build serialized payloads.
SHA256	`70af26f3fd65472877ba5a3676a60d4a7ea7bbcceddc8e363ca795f36bb96ac4`	Hash of dl/pwn.sh, an operator script recovered from the staging directory.
SHA256	`7e43fe3888ac282b04074916fc4c5e33697a9f254403537e552f11b7cbd4ac4b`	Hash of dl/fire2.sh, an earlier operator script used in the Graylog attack chain.
SHA256	`ab8c39638608738349fddb02f73a0bb5712809b22cd2863f57829e8d6f35c24d`	Hash of dl/fire3.sh, the operator’s Graylog attack orchestration script.
SHA256	`d2753dc8bb3ffc5b6aeea02a6bd2faa9d83c4d6f4c9e8ae207767fe6614609e3`	Hash of dl/fire.sh, an earlier operator script used in the Graylog attack chain.
SHA256	`f1f5f46f5e5e3d111779310cf3b57461a18f12f903a88290a035993dc72d6a14`	Hash of cb2/s2.ser, a serialized object used in the operator’s two-stage payload.