Huntress Investigates Web Shells on VMware Horizon Servers Amid Log4Shell Attacks
Summary
Huntress traced Cobalt Strike alerts to VMware Horizon servers, found web shells on exploited hosts, and recreated a trigger that ran a command. Its Process Insights EDR exposed the process tree and enabled a detector for web shell activity.
Key points
- Huntress analysts received Windows Defender alerts for Cobalt Strike on two organizations’ VMware Horizon servers; Defender blocked the RAT from executing.
- Huntress connected the activity to reports of attackers targeting Log4Shell-vulnerable VMware Horizon servers to establish persistent access through web shells.
- Researchers reviewed affected hosts and recreated a web shell backdoor trigger, which successfully ran a “whoami” command and demonstrated system access.
- Process Insights captured the command and displayed its process tree; Huntress created a detector for web shell triggers within 15 minutes.
- Huntress reported finding web shells and sending incident reports to partners, and urged customers to patch; it said some partners had run a mitigation script rather than applying patches.
- The article says VMware’s mitigation tool did not remove discovered web shells and recommends restoring affected systems from backups.
Article Details
- Attack Vectors
- Attackers exploited Log4Shell vulnerabilities in VMware Horizon servers to establish persistent access via web shells, according to the article's account of the related NHS alert.
- Web shell triggers enabled system access and execution of a simple “whoami” command.
- Cobalt Strike was detected on VMware Horizon servers; Windows Defender blocked its execution on the two initially reported systems.
- Cobalt Strike, cryptominers, and other malware were subsequently reported on VMware Horizon servers.
- Defensive Notes
- Patch vulnerable VMware Horizon servers; running the mitigation script alone does not constitute patching.
- The article reports that VMware's mitigation tool did not remove a discovered web shell; Huntress recommended restoring affected systems from backups.
- Use endpoint detection and response to monitor process behavior and investigate web shell triggers, including process trees.
- Monitor antivirus detections as part of a defense-in-depth strategy because blocked attackers may try another approach.
- Apply patching, security-focused processes, and multi-factor authentication as defense-in-depth practices.
MITRE ATT&CK
T1059.003 · Windows Command ShellA researcher recreated the web shell backdoor trigger and executed the Windows command “whoami”.T1210 · Exploitation of Remote ServicesThe article describes attackers exploiting Log4Shell vulnerabilities on VMware Horizon servers to gain access.T1505.003 · Web ShellThe article reports that attackers exploited Log4Shell vulnerabilities in VMware Horizon servers to establish persistent access via web shells.
People
Malware
Vendors
Products
Kibana(Rendered in Elastic Kibana with Huntress' Process Insights)Within 15 minutes, our team was able to create a detector based on this behavior and similar behaviors which allowed Process Insights to alert us of web shellManaged Antivirusthe endpoint from the RAT being executed. But one thing to consider, and a key reason we added our Managed Antivirus solution, is that attackers will often try something else if they are blocked. Monitoring antivirusProcess Insightsproduct team recommends we roll out our managed endpoint detection and response (EDR) capability, Process Insights, to all systems with VMware Horizon. This new endpoint detection and response (EDR) capability isVMware Horizonto do their job, one analyst notices a commonality between the two previous reports that both are VMware Horizon servers. After further review and some open-source research, we determine that this may be a biggerWindows DefenderAt 2:48pm ET, one of our analysts investigates a Windows Defender alert (we review these to weed out Defender false positives). After a quick investigation, it’s determined that it’s Cobalt Strike, a remote access tool