Full Report
Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more.
Analysis Summary
# Incident Report: VMware Horizon Exploitation via Log4Shell
## Executive Summary
Attackers are actively exploiting the Log4Shell (CVE-2021-44228) vulnerability in internet-facing VMware Horizon servers to deploy web shells and Cobalt Strike beacons. The campaign has transitioned from establishing persistence via modified JavaScript web shells to direct execution of PowerShell-based implants for command and control. Huntress identified that roughly 10% of surveyed servers were backdoored, emphasizing the critical need for immediate patching and forensic review.
## Incident Details
- **Discovery Date:** January 5, 2022 (NHS Alert); January 14, 2022 (Cobalt Strike Detection)
- **Incident Date:** December 25, 2021 – Ongoing
- **Affected Organization:** Multiple (approximately 25,000 servers exposed globally)
- **Sector:** Cross-sector (including Healthcare/NHS)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** December 25, 2021 (First wave)
- **Vector:** Log4Shell (CVE-2021-44228) vulnerability in VMware Horizon.
- **Details:** Attackers targeted the Log4J library within Horizon to execute remote commands.
### Lateral Movement
- **Details:** Attackers utilized Cobalt Strike beacons and web shells to establish a foothold for potential lateral movement, though specific internal movement details are omitted to focus on the initial breach.
### Data Exfiltration/Impact
- **Details:** Potential for full system takeover and data theft. Attackers gained `NT AUTHORITY\SYSTEM` privileges via web shells.
### Detection & Response
- **Discovery:** January 14, 2022 (14:58 ET) via Microsoft Defender alerts and subsequent EDR (Process Insights) monitoring.
- **Response Actions:** Deployment of specialized EDR agents to monitor `ws_tomcatservice.exe` and `node.exe` activity; release of mitigation guidance.
## Attack Methodology
- **Initial Access:** Exploitation of Log4Shell in VMware Horizon.
- **Persistence:** Installation of modified `absg-worker.js` web shells in the App Blast Gateway directory.
- **Privilege Escalation:** Exploits result in immediate `NT AUTHORITY\SYSTEM` (root) privileges.
- **Defense Evasion:** Use of modified web shells and PowerShell-based downloaders executed in memory.
- **Credential Access:** Not explicitly detailed, but implied via Cobalt Strike capability.
- **Discovery:** Reconnaissance of internet-facing Horizon servers (likely via Shodan).
- **Lateral Movement:** Cobalt Strike beacons.
- **Collection:** Data gathering via command execution.
- **Exfiltration:** C2 communication via port 8080.
- **Impact:** Remote Command Execution (RCE) and full server compromise.
## Impact Assessment
- **Financial:** Unknown; potential for ransomware deployment.
- **Data Breach:** High risk; attackers gained SYSTEM-level access to gateway servers.
- **Operational:** Significant disruption due to the need for emergency patching and server re-imaging.
- **Reputational:** High for organizations identified as vulnerable/unpatched.
## Indicators of Compromise
- **Network Indicators:**
- 185.112.83[.]116:8080 (C2 Server)
- **File Indicators:**
- `%ProgramFiles%\VMware\VMware View\Server\appblastgateway\absg-worker.js` (Modified with `child_process`)
- **Behavioral Indicators:**
- `ws_tomcatservice.exe` spawning `powershell.exe`
- `node.exe` spawning `cmd.exe` or `powershell.exe`
- Presence of the string `child_process` in Horizon JavaScript files.
## Response Actions
- **Containment:** Identified and isolated unpatched internet-facing servers.
- **Eradication:** Used VMware’s Horizon Mitigation tool to remove vulnerable libraries and web shells.
- **Recovery:** Restoration of servers from known-clean backups after patching.
## Lessons Learned
- **Key Takeaways:** Vulnerabilities in edge-facing infrastructure (like VDI gateways) are prioritized by threat actors for mass exploitation.
- **Gap Analysis:** A significant percentage (34%) of the observed environment remained unpatched weeks after the Log4Shell disclosure, highlighting delays in patch management cycles.
## Recommendations
- **Patching:** Immediately update VMware Horizon to the latest patched version.
- **Monitoring:** Implement EDR monitoring specifically for web server parent processes (`ws_tomcatservice.exe`) spawning shells.
- **Hardening:** Restrict outbound internet access from VDI infrastructure to known-necessary update sites only.
- **Audit:** Inspect the `\appblastgateway\` folder for unauthorized modifications.