vmware uag horizon destination server down

Attacker Technique - PowerShell Download Cradles (created: Thursday, January 3, 2019, 15:31:27 UTC).Rapid7 InsightIDR and MDR customers: Alerts generated by the following detection rules can assist in identifying successful VMware Horizon exploitation: Rapid7 services and research teams expect to see a continued strong upward trend in attacker activity directed at VMware Horizon instances vulnerable to Log4Shell exploits. The activity our teams are observing is similar to observed threat activity detailed by NHS Digital. Detailsīeginning Friday, January 14, 2022, Rapid7 Managed Detection & Response (MDR) began monitoring a sudden increase in VMware Horizon exploitation. We’re sharing our observed activities and indicators of compromise (IOCs) related to this activity.

We will update this blog with further information as it becomes available.Īttackers are actively targeting VMware Horizon servers vulnerable to Apache Log4j CVE-2021-44228 (Log4Shell) and related vulnerabilities that were patched in December 2021. This post is co-authored by Charlie Stafford, Lead Security Researcher.

Vmware uag horizon destination server down