So in short, you need to patch all the things to protect yourself… But:Īttempts to compromise Horizon servers are among the more targeted exploits of Log4Shell vulnerabilities because of their nature. The attempts to leverage Horizon, which continued and grew in number throughout January, were frequently associated with attempts to deploy cryptocurrency mining malware others had less clear motives, and may be associated with initial access brokers or ransomware actors. SophosLabs has observed these attacks in customer telemetry since the beginning of January. The attack used the Lightweight Directory Access Protocol resource call of Log4J to retrieve a malicious Java class file that modified existing legitimate Java code, adding a web shell that provided remote access and code execution to the attackers. In late December 2021 and in January 2022, there were multiple reports of active exploitation of the Log4Shell vulnerability in VMware Horizon servers. According to the report, the Log4Shell attacks target unpatched VMware Horizon with three different backdoors and four cryptocurrency miners.

And that trend appears to be continuing as Sophos researchers warned today that Log4Shell is being exploited to infect VMware Horizon servers with backdoors and crypto miners. Last year, I wrote about Log4Shell being actively exploited by threat actors to deliver malware and crypto miners.

Miners to infect vmware horizon servers