Some threat actors exploiting the Apache Log4j vulnerability have switched from LDAP callback URLs to RMI or even used both in a single request for maximum chances of success. This shift is a notable development in the ongoing attack and one that defenders need to be aware of when trying to secure all potential vectors.

Read full article on Bleeping Computer