Iranian Hackers Concentrating on VMware Horizon Log4j Flaws to Deploy Ransomware

A “doubtlessly damaging actor” aligned with the federal government of Iran is actively exploiting the well-known Log4j vulnerability to contaminate unpatched VMware Horizon servers with ransomware.

Cybersecurity agency SentinelOne dubbed the group “TunnelVision” owing to their heavy reliance on tunneling instruments, with overlaps in techniques noticed to that of a broader group tracked below the moniker Phosphorus in addition to Charming Kitten and Nemesis Kitten.

“TunnelVision actions are characterised by wide-exploitation of 1-day vulnerabilities in goal areas,” SentinelOne researchers Amitai Ben Shushan Ehrlich and Yair Rigevsky mentioned in a report, with the intrusions detected within the Center East and the U.S.

Additionally noticed alongside Log4Shell is the exploitation of Fortinet FortiOS path traversal flaw (CVE-2018-13379) and the Microsoft Change ProxyShell vulnerability to achieve preliminary entry into the goal networks for post-exploitation.

“TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell instructions, deploy backdoors, create backdoor customers, harvest credentials and carry out lateral motion,” the researchers mentioned.

The PowerShell instructions are used as a launchpad to obtain instruments like Ngrok and run additional instructions by the use of reverse shells which can be employed to drop a PowerShell backdoor that is able to gathering credentials and executing reconnaissance instructions.

SentinelOne additionally mentioned it recognized similarities within the mechanism used to execute the reverse internet shell with one other PowerShell-based implant referred to as PowerLess that was disclosed by Cybereason researchers earlier this month.

All via the exercise, the risk actor is alleged to have utilized a GitHub repository generally known as “VmWareHorizon” below the username “protections20” to host the malicious payloads.

The cybersecurity firm mentioned it is associating the assaults to a separate Iranian cluster not as a result of they’re unrelated, however owing to the truth that “there may be at current inadequate information to deal with them as similar to any of the aforementioned attributions.”