VMware Horizon servers are under active exploit by Iranian state hackers

Spread the love
Stylized version of Iranian flag made of ones and zeroes.

Enlarge (credit: Getty Images)

Hackers aligned with the government of Iran are exploiting the critical Log4j vulnerability to infect unpatched VMware users with ransomware, researchers said on Thursday.

Security firm SentinelOne has dubbed the group TunnelVision. The name is meant to emphasize TunnelVision’s heavy reliance on tunneling tools and the unique way it deploys them. In the past, TunnelVision has exploited so-called 1-day vulnerabilities—meaning vulnerabilities that have been recently patched—to hack organizations that have yet to install the fix. Vulnerabilities in Fortinet FortiOS (CVE-2018-13379) and Microsoft Exchange (ProxyShell) are two of the group’s better-known targets.

Enter Log4Shell

Recently, SentinelOne reported, TunnelVision has started exploiting a critical vulnerability in Log4j, an open source logging utility that’s integrated into thousands of apps. CVE-2021-44228 (or Log4Shell, as the vulnerability is tracked or nicknamed) allows attackers to easily gain remote control over computers running apps in the Java programming language. The bug bit the Internet’s biggest players and was widely targeted in the wild after it became known.

Read 9 remaining paragraphs | Comments

3 thoughts on “VMware Horizon servers are under active exploit by Iranian state hackers

  1. Please let me know if you’re looking for a article author for your site.

    You have some really great posts and I feel I would be a good asset.
    If you ever want to take some of the load off, I’d
    love to write some content for your blog in exchange for a link back to mine.

    Please send me an e-mail if interested. Thanks!

  2. I think this is one of the most vital information for me.
    And i am satisfied studying your article. But should statement on some basic things, The website style is perfect,
    the articles is in point of fact excellent : D. Excellent process,

Leave a Reply

Your email address will not be published. Required fields are marked *