Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

Attackers Hitting VMWare Horizon Servers With Log4j Exploits

Threat hunters in the U.K.’s National Health Service have raised an alarm for an unknown threat actor hitting vulnerable VMWare Horizon servers with exploits for the ubiquitous Log4j security flaw.

Threat hunters in the U.K.’s National Health Service have raised an alarm for an unknown threat actor hitting vulnerable VMWare Horizon servers with exploits for the ubiquitous Log4j security flaw.

The warning comes almost exactly one month after the first disclosure of a Log4j remote code execution vulnerability that threatens major damage on the internet and heightens the urgency for enterprise defenders to find and fix the issue.

According to an advisory from NHS Digital, attackers are exploiting the critical vulnerability in the Apache Tomcat service embedded within VMware Horizon.  

The NHS Digital team believes the attacks are being used to establish persistence within affected networks and noted that the attack likely consists of a reconnaissance phase, where the attacker uses the Java Naming and Directory Interface (JNDI) via Log4Shell payloads to call back to malicious infrastructure.

“Once a weakness has been identified, the attack then uses the Lightweight Directory Access Protocol (LDAP) to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service,” according to the alert.

[ READ: Exploits Swirling for Major Security Defect in Apache Log4j ]

“The web shell can then be used by an attacker to carry out a number of malicious activities such as deploying additional malicious software, data exfiltration, or deployment of ransomware,” it added.

VMWare has already shipped high-priority patches for numerous products affected by Log4j and previously acknowledged scanning attempts to identify signs of vulnerable installations.

On the targeted VMware Horizon platform, which is used by enterprises to run virtual desktops and apps across the hybrid cloud, the Log4j vulnerability carries a 10-out-of-10 critical rating.

The NHS Digital team also cautioned that additional VMware systems may be vulnerable and affected organisations should regularly review the VMSA-2021-0028 security advisory.

[READ: Microsoft Spots Multiple Nation-State APTs Poking at Log4j Flaw ]

Using artifacts from the VMWare Horizon attacks, security experts are urging organizations to look for evidence of ws_TomcatService.exe spawning abnormal processes, or any powershell.exe  processes containing ‘VMBlastSG’ in the command line.

Microsoft and others have previously warned that APT actors linked to China, Iran, North Korea and Turkey have already pounced and are actively exploiting the Log4j security defect. 

In a warning late last year, Redmond said nation-state threat actor activity ranged from experimentation during development, integration of the vulnerability to in-the-wild payload deployment, and exploitation against targets to achieve specific objectives.

Related: Google Finds 35,863 Java Packages Using Defective Log4j

Related: Microsoft Spots Multiple Nation-State APTs Exploiting Log4j Flaw

Related: Log4Shell Tools and Resources for Defenders (Continuously Updated)

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.