OTX Threat: Ukraine's State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell

Between May and September 2026, a Russian-speaking operator systematically targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker swept 9.1 million Ukrainian IP addresses, filtering 7,576 live hosts to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 CVEs: CVE-2018-14847, CVE-2021-41987 Sectors: Government, Hospitality