Attackers Hitting VMWare Horizon Servers With Log4j Exploits

Threat hunters in the U.K.’s National Health Service have raised an alarm for an unknown threat actor hitting vulnerable VMWare Horizon servers with exploits for the ubiquitous Log4j security flaw.

The warning comes almost exactly one month after the first disclosure of a Log4j remote code execution vulnerability that threatens major damage on the internet and heightens the urgency for enterprise defenders to find and fix the issue.

According to an advisory from NHS Digital, attackers are exploiting the critical vulnerability in the Apache Tomcat service embedded within VMware Horizon.  

The NHS Digital team believes the attacks are being used to establish persistence within affected networks and noted that the attack likely consists of a reconnaissance phase, where the attacker uses the Java Naming and Directory Interface (JNDI) via Log4Shell payloads to call back to malicious infrastructure.

“Once a weakness has been identified, the attack then uses the Lightweight Directory Access Protocol (LDAP) to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service,” according to the alert.

[ READ: Exploits Swirling for Major Security Defect in Apache Log4j ]

“The web shell can then be used by an attacker to carry out a number of malicious activities such as deploying additional malicious software, data exfiltration, or deployment of ransomware,” it added.

VMWare has already shipped high-priority patches for numerous products affected by Log4j and previously acknowledged scanning attempts to identify signs of vulnerable installations.

On the targeted VMware Horizon platform, which is used by enterprises to run virtual desktops and apps across the hybrid cloud, the Log4j vulnerability carries a 10-out-of-10 critical rating.

The NHS Digital team also cautioned that additional VMware systems may be vulnerable and affected organisations should regularly review the VMSA-2021-0028 security advisory.

[READ: Microsoft Spots Multiple Nation-State APTs Poking at Log4j Flaw ]

Using artifacts from the VMWare Horizon attacks, security experts are urging organizations to look for evidence of ws_TomcatService.exe spawning abnormal processes, or any powershell.exe  processes containing ‘VMBlastSG’ in the command line.

Microsoft and others have previously warned that APT actors linked to China, Iran, North Korea and Turkey have already pounced and are actively exploiting the Log4j security defect. 

In a warning late last year, Redmond said nation-state threat actor activity ranged from experimentation during development, integration of the vulnerability to in-the-wild payload deployment, and exploitation against targets to achieve specific objectives.

Related: Google Finds 35,863 Java Packages Using Defective Log4j

Related: Microsoft Spots Multiple Nation-State APTs Exploiting Log4j Flaw

Related: Log4Shell Tools and Resources for Defenders (Continuously Updated)