Log4Shell Attackers Target VMware Horizon Servers, Huntress Reports
Summary
Huntress says attackers exploited Log4Shell to target VMware Horizon servers, affecting a Blue Tree Technology machine despite prior server patching. Its ThreatOps team identified malicious commands and helped partners remediate the threat that day.
Key points
- Huntress reported similar Windows Defender alerts involving two partner organizations, with attackers targeting VMware Horizon servers through Log4Shell.
- A Blue Tree Technology machine hosted by IntelliData Solutions was affected, although IntelliData had already patched its VMware Horizon servers.
- Huntress said its managed EDR identified partners targeted with malicious executable commands and enabled incident reports with mitigation information.
- Huntress ThreatOps worked with Blue Tree Technology and IntelliData Solutions on remediation; the company said the threat was addressed by the end of the day.
Article Details
- Victim Organization
- Blue Tree Technology
- Incident Type
- Log4Shell exploitation targeting VMware Horizon servers, resulting in malicious executable commands and a Cobalt Strike implant detected in the network.
- Disclosure Date
- 2022-06-28
- Operational Impact
- Threats were mitigated by the end of the day; no weekend disruption was reported.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
People
Malware
Vendors
Products
Huntress Managed EDRHomeBlogAll in a Day’s Work: Fighting Log4Shell with Huntress Managed EDRVMware HorizonThe commonality? Hackers were exploiting Log4Shell vulnerabilities to target VMware Horizon servers.Windows DefenderBlue Tree Technology, a Missouri-based managed service provider (MSP). Our ThreatOps team received a Windows Defender alert for Blue Tree’s environment—and just a few minutes later, a similar alert popped up for a