Threat Actors Target VMware Servers by Exploiting Log4Shell Vulnerability

The Log4Shell RCE vulnerability with code CVE-2021-44228 continues to be exploited by state-backed threat actors. Attackers utilize the vulnerability to target VMware Horizon and Unified Access Gateway servers.

By exploiting the Log4Shell vulnerability, attackers can gain lateral movement capability in networks and access systems where sensitive data is stored.

APT groups place loader malware with embedded executables that allow remote command and control (C2) on infected devices.

CISA Warns VMware Server Users

The joint security advisory, published by US Cybersecurity and Infrastructure Security Agency (CISA) and Coast Guard Cyber Command (CGCYBER), shared details of two incidents where threat actors targeted VMware servers by exploiting the Log4Shell vulnerability. 

Incident 1:

In the threat actor hunting conducted by CGCYBER, the attackers exploited the Log4Shell vulnerability to target a company using VMware Horizon. Threat actors, gaining access to the system, uploaded a file named hmsvc[.]exe to the compromised system.

According to the analysis, the file named hmsvc[.]exe was running as NT AUTHORITYSYSTEM, which is the highest privilege in the Windows system. How the attackers escalated their privileges is unknown.

The hmsvc[.]exe file creates the C:WindowsSystem32TasksLocal Session Updater, a Scheduled Task that runs malicious code hourly when the first run.

The malicious file contains the 658 dump64[.]exe remote access tool that supports C2 as an embedded executable. Through this file, operations performed on the target Windows system can be logged, additional loads can be loaded and executed, and access to the user interface is provided. 

Incident 2:

CISA observed bidirectional traffic between the victim organization and a possible APT IP address and found that threat actors were gaining access to an unpatched VMware Horizon server using Log4Shell.

Using PowerShell scripts to invoke 109.248.150[.]13 via HTTP after gaining access, the attackers attempted to simultaneously download and run a malware file from 109.248.150[.]13.

The following action of the threat actors was to use RDP to laterally migrate to the organization’s security management server, certificate server, databases containing sensitive data, email relay server, and recovery network. They also hijacked the administrator account credentials.

Finally, they loaded a loader malware containing executable files onto the system. Security researchers think the malware could be a modified version of SysInternals LogonSessions, Du, or PsPing.

Loader Malware Detected by CISA

• SvcEdge[.]exe
• Odbccads[.]exe
• Praiser[.]exe
• Fontdrvhosts[.]exe
• winds[.]exe

See VMware’s security advisory for detailed information on the affected products and vulnerability, and this article for mitigation measures.

(CISA states that all unpatched servers are compromised and IoCs should be carefully monitored. (See: MAR-10382254-1 and MAR-10382580-1)

IOCs and TTPs

IOCs:

(Source: Log4Shell | CISA )

TTPs:

(Source: Log4Shell | CISA )

Use SOCRadar® FOR FREE 1 YEAR

With SOCRadar® Free Edition, you’ll be able to:

• Prevent Ransomware attacks with Free External Attack Surface Management
• Get Instant alerts for fraudulent domains against phishing and BEC attacks
• Monitor Deep Web and Dark Net for threat trends
• Get vulnerability intelligence when a critical zero-day is disclosed
• Get IOC search & APT tracking & threat hunting in one place
• Get notified with data breach detection

Free for 12 months for one corporate domain and 100 auto-discovered digital assets.
Get Free Access.