Log4Shell Still Being Exploited to Hack VMWare Servers to Exfiltrate Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the Coast Guard Cyber Command (CGCYBER), on Thursday unveiled a joint advisory warning of continued makes an attempt on the section of threat actors to exploit the Log4Shell flaw in VMware Horizon servers to breach goal networks.

“Due to the fact December 2021, several risk actor teams have exploited Log4Shell on unpatched, general public-struggling with VMware Horizon and [Unified Access Gateway] servers,” the agencies mentioned. “As part of this exploitation, suspected APT actors implanted loader malware on compromised units with embedded executables enabling remote command-and-regulate (C2).”

In a person occasion, the adversary is explained to have been equipped to go laterally inside of the victim network, obtain access to a catastrophe restoration network, and obtain and exfiltrate delicate legislation enforcement facts.

Log4Shell, tracked as CVE-2021-44228 (CVSS rating: 10.), is a distant code execution vulnerability impacting the Apache Log4j logging library which is employed by a vast vary of shoppers and organization providers, websites, apps, and other products.

Effective exploitation of the flaw could permit an attacker to ship a specifically-crafted command to an influenced program, enabling the actors to execute malicious code and seize regulate of the goal.

Based mostly on details collected as portion of two incident response engagements, the businesses said that the attackers weaponized the exploit to drop rogue payloads, which include PowerShell scripts and a remote obtain tool dubbed “hmsvc.exe” which is equipped with abilities to log keystrokes and deploy more malware.

“The malware can operate as a C2 tunneling proxy, permitting a remote operator to pivot to other devices and shift further more into a network,” the organizations pointed out, incorporating it also provides a “graphical person interface (GUI) accessibility over a goal Windows system’s desktop.”

The PowerShell scripts, observed in the production natural environment of a second firm, facilitated lateral motion, enabling the APT actors to implant loader malware containing executables that consist of the capacity to remotely keep track of a system’s desktop, achieve reverse shell entry, exfiltrate information, and add and execute subsequent-stage binaries.

In addition, the adversarial collective leveraged CVE-2022-22954, a distant code execution vulnerability in VMware Workspace One particular Access and Id Supervisor that arrived to light in April 2022, to implant the Dingo J-spy web shell.

Ongoing Log4Shell-similar action even following more than 6 months indicates that the flaw is of large curiosity to attackers, together with state-sponsored innovative persistent threat (APT) actors, who have opportunistically targeted unpatched servers to get an original foothold for observe-on exercise.

According to cybersecurity organization ExtraHop, Log4j vulnerabilities have been subjected to relentless scanning makes an attempt, with economic and health care sectors rising as an outsized current market for prospective attacks.

“Log4j is in this article to continue to be, we will see attackers leveraging it once again and yet again,” IBM-owned Randori stated in an April 2022 report. “Log4j buried deep into levels and levels of shared 3rd-party code, foremost us to the summary that we will see scenarios of the Log4j vulnerability being exploited in providers used by companies that use a lot of open up source.”

Discovered this post fascinating? Stick to THN on Fb, Twitter  and LinkedIn to browse extra exceptional material we submit.

Some pieces of this short article are sourced from:
thehackernews.com