log4shell to infect vmware horizon servers

The cybersecurity company said it’s associating the attacks to a separate Iranian cluster not because they are unrelated, but owing to the fact that “there is at present insufficient data to treat them as identical to any of the aforementioned attributions. Apart from that, they also uncovered that the attacks also involved the deployment of crypto miners and backdoors.

SentinelOne also said it identified similarities in the mechanism used to execute the reverse web shell with another PowerShell-based implant called PowerLess that was disclosed by Cybereason researchers earlier this month.Īll through the activity, the threat actor is said to have utilized a GitHub repository known as “VmWareHorizon” under the username “protections20” to host the malicious payloads. Cybersecurity experts recently discovered that the Log4Shell exploitation is happening, and the hackers are attacking the VMware Horizon servers.

The PowerShell commands are used as a launchpad to download tools like Ngrok and run further commands by means of reverse shells that are employed to drop a PowerShell backdoor that’s capable of gathering credentials and executing reconnaissance commands.

Log4shell to infect vmware horizon servers