eset_threat_report_h12023.pdf (8 MB)

ESET's H1 2023 threat report mentions North Korea-aligned exploitation in its Log4Shell section rather than as a full actor case study. The report says CISA warned that North Korea-aligned ransomware operators had targeted healthcare systems in South Korea and the United States, with Log4Shell exploitation used as one access technique. It also cites AhnLab reporting that Lazarus exploited the same vulnerability. ESET does not separate telemetry by CVE-2021-44228 and CVE-2021-45046 in that passage, so the safe takeaway is that unpatched Log4j remained relevant to DPRK-linked intrusion and ransomware risk against healthcare environments.