The Numbers Behind Log4j Vulnerability CVE-2021-44228

To get immediate support from our incident response team on Log4j CLICK HERE

Contact Us

Contact Us

For any questions or inquiries concerning the Log4j vulnerability please email
[email protected]


30 Days Free AppSec & Free Lifetime Protection Against Log4j Exploits

The Only Security Solution Which Pre-Emptively Prevented the Log4j Exploit!

Scan for Log4j

Scan Now for Log4j Vulnerabilities

A fully automated and extensive scanner for finding vulnerable log4j public hosts

*Updated 29.12.2021 10:23 AM PST

Precisely one year after the SolarWinds Hack, the groundbreaking supply chain attack the world experienced, and while organizations are still struggling to protect the software supply chain from third-party risk, the Apache Log4j vulnerability exploit has caught security teams during a weekend. Unlike other major cyber-attacks that involve one or a limited number of software, Log4j is basically embedded in every Java based product or web service. It is very difficult to manually remediate it. Once an exploration was published (on Friday), scans of the internet ensued (to allocate surfaces which are vulnerable due to this incident). Those who won’t implement a protection are probably already scanned by malicious actors.

Since Friday, December 9th, when the vulnerability was reported, actors around the world are on the lookout for exploits. The number of combinations of how to exploit it give the attacker many alternatives to bypass newly introduced protections. It means that one layer of protection is not enough, and only multi-layered security posture would provide a resilient protection. Three days after the outbreak, we are summing up what we see until now, which is clearly a cyber pandemic that hasn’t seen its peak yet.

A True Cyber Pandemic

Diving into the numbers behind the attack, gathered and analyzed by Check Point Research, we see a pandemic-like spread since the outbreak on Friday, by the beginning of the week, on Monday.
Early reports on December 10th showed merely thousands of attack attempts, rising to over 40,000 during Saturday, December 11th. Twenty-four hours after the initial outbreak our sensors recorded almost 200,000 attempts of attack across the globe, leveraging this vulnerability. As of the time these lines are written, 72 hours post initial outbreak, the number hit over 800,000 attacks.

It is clearly one of the most serious vulnerabilities on the internet in recent years, and the potential for damage is incalculable.

Check Point Research witnessed new variations of the original exploit being introduced rapidly- over 60 in less than 24 hours.
When we discussed the Cyber pandemic, this is exactly what we meant – quickly spreading devastating attacks.

Corporate networks impacted globally

One of the most dramatic characteristics of a cyber pandemic are major vulnerabilities in popular software and services, which impact an enormous number of organizations across the globe, spreading like wild fire.

Since we started to implement our protection we prevented over 4,300,000 attempts to allocate the vulnerability, over 46% of those attempts were made by known malicious groups.
We have so far seen an attempted exploit of over 48% of corporate networks globally.

*Updated 20.12.2021 01:30 AM PST

This diagram use figures for the 13.12.2021

Corporate numbers impacted by countries

The spread per countries is overwhelming and crosses continent and regions, ranging to over 90 countries in all regions. The impact itself is also wide and reaches peaks of countries seeing over 60% of corporate networks impacted, and many distributions seeing over 50% of corporate networks within the country beings impacted.

*A detailed breakdown per countries included in Annex 1

On Tuesday (12/14/21), we showed how such an attempt resulted in real life attack of a crypto mining group on 5 countries.

Wednesday (12/15/21), we can report that a known Iranian hacking group (commonly associated with the local regime),named “Charming Kitten” or APT 35, is also behind an attempt to exploit the Log4j vulnerability against 7 targets in Israel (from the government and business sector) in the last 24 hours.

We have blocked these attacks, as we witnessed communications between a server used by this group and the targets in Israel.

The scope of this attack was between 6am -4pm PST (1600-0200 TLV time). There’s no evidence for the group’s related activity on targets outside of Israel.

We will continue to investigate attacks related to Log4j. Our reports of the last 48 hours prove that both criminal hacking groups and nation state actors are engaged in the exploration of this vulnerability, and we should all assume more such actors’ operation are to be revealed in the coming days.

The Brain behind Check Point’s threat prevention

The statistics and data used in this report present data detected by Check Point’s Threat Prevention technologies, stored and analyzed in ThreatCloud. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. ThreatCloud is actually the brain behind Check Point Software’s threat prevention power, combines big data threat intelligence with advanced AI technologies to provide accurate prevention to all Check Point Software customers.

Instant protections from the most significant unknown software vulnerabilities
All software vulnerabilities that are found by CPR or seen in the wild, such as Log4j, are immediately fed to ThreatCloud, which propagates the appropriate protections throughout Check Point’s products, so that all Check Point customers are instantly protected with no patching needed. That is exactly what happened last weekend. As soon as the Log4j vulnerability was reported on December 9, all relevant protections were propagated through all of Check Point products (refer to sk176884).


This vulnerability, because of the complexity in patching it and easiness to exploit, seems that it will stay with us for years to come, unless companies and services take immediate action to prevent the attacks on their products by implementing a protection.

Since the outbreak of the COVID-19 pandemic, society has already gotten used to learning about variants, spread and other terminology that is taken from epidemiology theories. The phenomena the world is witnessing with the exploitation of this vulnerability is very much identical.
Given the upcoming holiday seasons, when security teams may be slower to implement protective measure, the threat is imminent. This acts precisely like a cyber pandemic — highly contagious, spreads rapidly and has multiple variants, which force more ways to attack.

Log4j pandemic visualization

How can Check Point Help?

Check Point Infinity provides protection against the Log4j Vulnerability.

We invite you to visit our dedicated website to learn more about this vulnerability and how Check Point products ensure you stay protected

To help customers, we are providing informative and actionable resources based on our R&D teams’ experience, expertise and insights.

We will continue to update on any new development of this significant security event.
Our technical support teams are available for you 24/7 and we are all at your service to make sure you’ll stay protected.

Annex 1 – Detailed breakdown – Impact per country

Top values of country name Impact
Angola 45%
Argentina 48%
Australia 52%
Austria 59%
Bahrain 34%
Belarus 37%
Belgium 58%
Bolivia 37%
Bosnia and Herzegovina 60%
Brazil 59%
Bulgaria 45%
Canada 48%
Chile 52%
China 38%
Colombia 60%
Costa Rica 49%
Croatia 51%
Cyprus 52%
Czech Republic 60%
Denmark 59%
Dominican Republic 44%
Ecuador 45%
El Salvador 25%
Estonia 62%
Finland 48%
France 51%
Georgia 34%
Germany 54%
Greece 62%
Guatemala 43%
Honduras 47%
Hong Kong 48%
Hungary 60%
India 46%
Indonesia 49%
Ireland 55%
Israel 58%
Italy 54%
Jamaica 42%
Japan 41%
Kazakhstan 41%
Kenya 57%
Kuwait 41%
Latvia 47%
Luxembourg 50%
Macao 57%
Macedonia 44%
Malaysia 52%
Malta 55%
Mexico 36%
Mongolia 60%
Morocco 39%
Nepal 70%
Netherlands 49%
New Zealand 61%
Nicaragua 44%
Nigeria 46%
Norway 58%
Panama 45%
Paraguay 67%
Peru 48%
Philippines 52%
Poland 53%
Portugal 50%
Qatar 43%
Republic of Korea 42%
Republic of Lithuania 29%
Romania 38%
Russia 52%
Saudi Arabia 28%
Serbia 58%
Singapore 44%
Slovakia 49%
Slovenia 67%
South Africa 57%
Spain 45%
Sri Lanka 12%
Sweden 56%
Switzerland 47%
Taiwan 49%
Thailand 43%
Trinidad and Tobago 59%
Turkey 62%
Ukraine 39%
United Arab Emirates 43%
United Kingdom 47%
United States 46%
Uruguay 47%
Uzbekistan 26%
Vietnam 33%
Zambia 52%