The Washington Post had an article about the exploitation of Log4Shell. According to CISA’s advisory AA22-320A, the hackers exploited the Log4Shell vulnerability (CVE-2021-44228) in an unpatched VMware Horizon server. From there they installed the XMRig cryptominer, moved laterally to a domain controller, harvested credentials with Mimikatz and tunnelled RDP through ngrok reverse proxies. The agencies had until December 28 to complete the vulnerability mitigation. The hacking group compromised the target as early as February. In February, SentinelLabs described an Iranian-aligned cluster it calls TunnelVision doing exactly this: exploiting Log4j in VMware Horizon and tunnelling RDP with ngrok, with partial overlap to what CrowdStrike tracks as Nemesis Kitten. CISA’s advice for anyone who did not patch Horizon right after December 2021: assume compromise and go hunting.
