Hi there - I’m running the latest version of Umbrel on a Raspberry PI 4 with an 16GB MCSD and 1 TB SSD. I recently updated the wifi network in my home to use Netgear Orbi wifi 6 mesh network to get better coverage in my home. I have the umbrel hooked up to an ethernet port on the main router. Whe…

I have just installed this week the latest version of umbrel os, and after security tests i see the device reaching out to known listed malware/log4j targets, i will investigate this further: 1 - stopping all apps (I had around 4 running) 2 - starting and checking apps individually My questions: …

Oh, if that’s true, it sounds serious… Could you provide more info about the issue what you have found, please? What addresses it’s reaching out? Or maybe you’ve found more about it already? Any suspicious apps/processes? Thank you.

[image] Umbrel os Security - Malware detected - log4j? General Discussions I have just installed this week the latest version of umbrel os, and after security tests i see the device reaching out to known listed malware/log4j targets and on ports 7777, 13962, 14178, 60668, …

Thank you for the info. As for now I can confirm a sporadic traffic from my Umbrel targeting port 7777 somewhere, but it looks like a normal I2P traffic which my Bitcoin node is using. Nothing else on the mentioned ports detected so far. Umbrel 1.4.2. Will update if I spot anything new.

a few from the range of 23.128.248.0/24 and a single one 141.94.45.159. apparently it’s originating from the bitcoin node app.

I advise a check of the ips against know log4j malware lists, and maybe you can help with the more important questions: 1 - Does Umbrel or anyone checks the base os for security concerns? 2 - Does Umbrel or anyone checks the apps on marketplace?

Unfortunately I can’t help with the questions you brought up here. I’m just a common user. The project is opensource so in theory anyone can do the necessary checks. I believe the developers do, but yeah, maybe it’s just my false beliefs.. :man_shrugging:

[image] DRaf: Does Umbrel or anyone checks the base os for security concerns I did. Its like the raspberry pi where you need to regenenerate ssh keys. I did notice something odd with the kernel based firewall as there are netfilter and iptables entries. Which its common practice to use one o…

My umbrel got flagged (internally) for outgoing connections to log4j know ip lists (check specific thread - Umbrel os Security - Malware detected - log4j? )

Malware Detected on Umbrel

Support and Troubleshooting

DRaf July 28, 2025, 1:01pm 4

More info, and i will update further

Topic		Replies	Views
Umbrel os Security - Malware detected - log4j? General Discussions	1	222	July 31, 2025
Just started, General questions, Contribute General Discussions	2	710	July 22, 2022
Network Security General Discussions	3	563	August 7, 2021
Umbrel doesn 't start Support and Troubleshooting	1	576	July 15, 2022
Umbrel-startup.service: Failed with result 'exit-code' Support and Troubleshooting	9	2200	May 8, 2022

Malware Detected on Umbrel

Related topics