NHS Warns of Attackers Targeting Log4j Flaws in VMware Horizon

An unknown threat group has been observed attacking VMware Horizon servers running versions with Log4j vulnerabilities.

Dark Reading Staff, Dark Reading

January 7, 2022

1 Min Read
Dark Reading logo in a gray background | Dark Reading

The UK's National Health Service (NHS) Digital has issued an advisory warning of attackers actively targeting Log4j vulnerability CVE-2021-44228 in VMware Horizon servers to establish persistence.

Officials say the threat group is unknown. The observed attacks target the Log4j vulnerability in the Apache Tomcat service, which is embedded within VMware Horizon.

Their attack activity likely contains a reconnaissance phase, in which they use the Java Naming and Directory Interface (JNDI) via Log4Shell payloads to call back to malicious infrastructure, the NHS wrote in its advisory.

"Once a weakness has been identified, the attack then uses the Lightweight Directory Access Protocol (LDAP) to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service," officials explained.

The attacker could then use this Web shell to conduct malicious actions such as deploying more malware, exfiltrating data, or launching a ransomware attack. In the advisory, the NHS noted more VMware systems may be vulnerable and companies should review the VMSA-2021-0028 security advisory: VMware Response to Apache Log4j Remote Code Execution Vulnerability

Read more details here.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights