Equifax breach tied to unpatched Apache Struts vulnerability
Equifax disclosed a breach that exposed sensitive personal information of a large portion of the U.S. population. Congressional investigations concluded the incident involved exploitation of an unpatched Apache Struts vulnerability (CVE-2017-5638). Regulators announced major financial settlements and remediation obligations, including a settlement involving the FTC, CFPB, and states.
First reported September 7, 2017Breachhigh overall confidence
Public investigations focused on control failures and exploitation path; definitive public attribution to a specific actor is not established in the cited sources.
T1190: Congressional reports tied the breach to exploitation of a public-facing web application vulnerability in Apache Struts.
Mitigations
Now
Patch/upgrade Apache Struts (Equifax affected application) to a fixed versionCloses the specific weakness used for initial access and reduces the window for opportunistic exploitation.
Soon
Restrict or remove direct internet exposure for the affected serviceReduces the attack surface and limits repeat exploitation while validation and remediation are underway.
Later
Implement rapid vulnerability response SLAs and external attack-surface monitoringImproves time-to-patch and helps detect newly exposed assets or known-vulnerable versions before attackers do.
Detection ideas
Detect exploit attempts in web/WAF logs
Look for request paths/parameters and user agents matching published IOCs for the exploited vulnerability; alert on spikes from new source IPs.
Data sources: WAF logs, Reverse proxy logs, Web server access logs
Alert on suspicious web server child processes / web shells
Alert when web server processes (w3wp/httpd/nginx) spawn shells or write new executable/script files into web directories (e.g., *.aspx, *.jsp, *.php).
Data sources: EDR telemetry, Process creation logs, File creation events
