Full Report
See how Huntress Managed Endpoint Detection and Response (EDR) helped combat follow-on attacks against VMware Horizon servers in real-time.
Analysis Summary
# Incident Report: Log4Shell Exploitation of VMware Horizon Servers
## Executive Summary
In January 2022, threat actors actively exploited the Log4Shell vulnerability within VMware Horizon servers to deploy Cobalt Strike beacons and establish persistent access. Huntress Managed EDR (Process Insights) and Managed Antivirus identified multiple concurrent attacks across different organizations, allowing for rapid detection and isolation. The incident highlights the tendency for attackers to leverage holiday weekends and known vulnerabilities (Log4j) to target infrastructure software.
## Incident Details
- **Discovery Date:** January 14, 2022
- **Incident Date:** January 14, 2022 (Ongoing through holiday weekend)
- **Affected Organization:** Multiple (Huntress Partners/Customers)
- **Sector:** Various
- **Geography:** Global (specifically referenced UK NHS alerts)
## Timeline of Events
### Initial Access
- **Date/Time:** January 14, 2022, 14:48 ET
- **Vector:** Exploitation of Log4Shell (CVE-2021-44228) vulnerability.
- **Details:** Attackers targeted VMware Horizon servers to execute remote code.
### Lateral Movement
- **Details:** Attackers deployed Cobalt Strike beacons, a Remote Access Tool (RAT) commonly used to move laterally through a network, escalate privileges, and deploy secondary payloads like ransomware.
### Data Exfiltration/Impact
- **Details:** While the specific article focuses on the prevention phase, the intended impact was the establishment of persistent unauthorized access and the potential deployment of ransomware.
### Detection & Response
- **14:48 ET:** Huntress ThreatOps investigates a Windows Defender alert identifying Cobalt Strike.
- **15:00 ET:** A second, identical alert is triggered from a completely different organization.
- **17:00 ET:** Analysts correlate both attacks to VMware Horizon servers and link them to earlier NHS cybersecurity alerts regarding Log4Shell.
- **19:38 ET:** Huntress begins rolling out Managed EDR (Process Insights) capabilities to all systems running VMware Horizon to monitor for non-persistent malicious process behavior.
## Attack Methodology
- **Initial Access:** Log4Shell vulnerability exploitation on VMware Horizon.
- **Persistence:** Web shells and Cobalt Strike beacons.
- **Defense Evasion:** Use of non-persistent malicious processes to avoid traditional file-based detection.
- **Lateral Movement:** Cobalt Strike RAT capabilities.
- **Impact:** Potential ransomware deployment and total network compromise.
## Impact Assessment
- **Financial:** Preventative measures likely saved affected organizations from significant ransomware recovery costs.
- **Data Breach:** Attempted unauthorized access; volume of data exfiltration not specified in this recap.
- **Operational:** Disruption to VMware Horizon server stability and emergency patching requirements.
- **Reputational:** High risk for organizations managing sensitive data via remote access infrastructure.
## Indicators of Compromise
- **Behavioral indicators:** `java.exe` spawning unusual child processes (e.g., cmd.exe, powershell.exe); execution of Cobalt Strike beacons; unauthorized web shell creation on VMware Horizon directories.
## Response Actions
- **Containment measures:** Deployment of Managed EDR to monitor process-level activity in real-time.
- **Eradication steps:** Automated and manual termination of malicious processes identified by ThreatOps.
- **Recovery actions:** Reporting findings to partners for immediate patching of VMware Horizon instances.
## Lessons Learned
- **Context is King:** Individual AV alerts may seem isolated, but correlating them by server type (VMware Horizon) revealed a widespread campaign.
- **Holiday Timing:** Threat actors intentionally choose holiday weekends to exploit reduced staffing in IT departments.
- **Defense in Depth:** While Windows Defender blocked initial files, EDR was necessary to see the "bigger picture" of the exploitation attempt.
## Recommendations
- **Patch Management:** Immediately ensure all VMware Horizon servers are patched against Log4j vulnerabilities.
- **Endpoint Monitoring:** Implement EDR solutions that monitor process execution patterns, not just file signatures.
- **Proactive Hunting:** During holiday periods, increase monitoring levels for externally facing infrastructure.