Huntress Finds Cobalt Strike Delivered Through VMware Horizon Log4Shell Exploitation

Summary

Huntress found 18 of 180 analyzed VMware Horizon servers backdoored and reported a later Log4Shell exploitation wave delivering Cobalt Strike. Process-parent analysis suggested the new deployments exploited Horizon directly, not web shells.

Key points

In Huntress’ sample of 180 Horizon servers, 18 had a modified absg-worker.js web shell; 62 were unpatched and internet-facing at the time of analysis.
Huntress reported a separate exploitation wave on January 14 that delivered a Cobalt Strike implant using a PowerShell-based downloader.
The downloader contacted 185.112.83[.]116 for command and control, according to Huntress and other security researchers.
Huntress’ process analysis suggested the Cobalt Strike deployments exploited Horizon directly: the observed PowerShell process descended from ws_tomcatservice.exe rather than the node.exe associated with web-shell abuse.
Huntress advised checking for vulnerable Log4j libraries and web shells, reviewing process histories for abnormal PowerShell launches, and patching Horizon servers immediately.
For systems with a web shell, VMware recommended taking the system offline and engaging incident responders; Huntress also suggested restoring from a pre-December 25 backup and cautioned that attackers may have moved laterally.

Article Details

Attack Vectors: Attackers exploited Log4Shell vulnerabilities in internet-facing VMware Horizon servers to establish persistent access through web shells.
A later exploitation wave used a PowerShell-based downloader to deliver a Cobalt Strike implant; the article attributes this activity to exploitation of Horizon itself, rather than abuse of web shells.
The article reports that the modified absg-worker.js web shell enabled unauthenticated remote command execution as NT AUTHORITY\SYSTEM.
Defensive Notes: Patch VMware Horizon servers immediately and assess whether internet-facing, unpatched systems may have been compromised.
Run VMware’s Horizon Mitigation tool with /verbose to check for a vulnerable Log4J library or a child_process-based web shell.
Inspect files under %ProgramFiles%\VMware\VMware View\Server\appblastgateway\ for the child_process string.
Review historical process records for abnormal processes spawned by node.exe or ws_TomcatService.exe, including PowerShell.
If a web shell is discovered, VMware recommends taking the system offline and engaging an incident response team. Huntress also recommends restoring from a backup made before December 25, 2021.
Proceed cautiously when remediating because attackers may have used CVE-2021-44228 and CVE-2021-45046 to move laterally within the network.

Indicators of compromise

Type	Indicator	Context
IPV4	`185[.]112[.]83[.]116`	Reported command-and-control callback address for the Cobalt Strike payload.
URL	`hxxp[:]//185[.]112[.]83[.]116:8080/drv`	Payload-download URL used by the PowerShell-based downloader to retrieve the Cobalt Strike payload.