exploited miners to vmware horizon servers

Sophos believes that some of the backdoors may be delivered by Initial Access Brokers looking to secure persistent remote access to a high-value target that they can sell to other attackers, such as ransomware operators. Many organizations may be unaware of the vulnerability lurking within their infrastructure, particularly in commercial, open-source, or custom software that doesn't have regular security support, Log4J is installed in hundreds of software products. Widely used applications such as VMware Horizon exposed to the internet and need to be manually updated are particularly vulnerable to exploitation at scale. 'The discovery of this vulnerability is nothing short of a Fukushima moment for the cybersecurity industry.'Īccording to a senior security researcher at Sophos, Sean Gallagher, Sophos detections reveal waves of attacks targeting Horizon servers, starting in January, and delivering a range of backdoors and cryptominers to unpatched servers as scripts to collect some device information. The vulnerability was discovered and patched last December.Īmit Yoran, CEO of cybersecurity company Tenable, said that the Apache Log4j Remote Code Execution Vulnerability is the last decade's single most significant, critical vulnerability. Log4Shell is a remote code execution vulnerability in the Java logging component, Apache Log4J, embedded in hundreds of software products. Attackers use the Log4Shell vulnerability to deliver backdoors and profiling scripts to unpatched VMware Horizon servers.Ĭybersecurity company Sophos said that multiple adversaries are targeting vulnerable Horizon servers, paving the way for persistent access and future ransomware attacks.

Exploited miners to vmware horizon servers