Cyber threat actors, including state-sponsored APT groups, continue to exploit CVE-2021-44228 (Log4Shell) in unpatched VMware Horizon and Unified Access Gateway (UAG) servers to gain initial access and move laterally within organizations. They deploy loader malware such as hmsvc.exe with embedded payloads to enable remote command and control, data exfiltration, and persistence. #Log4Shell #hmsvc
Keypoints
- Since December 2021, threat actor groups have exploited Log4Shell on unpatched, public-facing VMware Horizon and UAG servers to gain initial access to networks.
- Victim 1 involved hmsvc.exe masquerading as a legitimate Windows service with an embedded 658_dump_64.exe loader that provides remote C2 capabilities, including keylogging and GUI access.
- hmsvc.exe creates an hourly Scheduled Task and uses encrypted C2 communications to a hard-coded server, with connections to 192.95.20.8 over port 4443.
- Victim 2 involved multiple loader malware variants (SvcEdge.exe, odbccads.exe, praiser.exe, fontdrvhosts.exe, winds.exe) injecting encrypted payloads and communicating with several C2 IPs (e.g., 134.119.177.107, 162.245.190.203, 155.94.211.207, 185.136.163.104).
- Actors used PowerShell scripts to fetch additional payloads from external hosts, moved laterally via RDP, and exfiltrated data from production environments.
- Webshell activity (error_401.jsp) and a Dingo J-spy webshell, plus newdev.dll, expanded remote access and data theft capabilities.
- Mitigations emphasize patching, isolating compromised systems, minimizing internet exposure, using WAFs, and strengthening IAM (MFA, least privilege); incident response guidance and reporting to CISA/USCG are provided.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – “exploited Log4Shell on unpatched, public-facing VMware Horizon and UAG servers to obtain initial access to networks.”
- [T1059.001] Command and Scripting Interpreter: PowerShell – “PowerShell scripts [T1059.001] to callout to 109.248.150[.]13 via HTTP [T1071.001] to retrieve additional PowerShell scripts.”
- [T1053.005] Scheduled Task – “creates the Scheduled Task [T1053.005], C:WindowsSystem32TasksLocal Session Updater, which executes malware every hour.”
- [T1036.004] Masquerading: Masquerade Task or Service – “hmsvc.exe masquerades as a legitimate Microsoft Windows service (SysInternals LogonSessions software) … embedded with malicious packed code.”
- [T1505.003] Web Shell – “error_401.jsp is a webshell designed to parse data and commands from incoming HTTP requests, providing a remote operator C2 capabilities.”
- [T1021.001] Remote Services: Remote Desktop Protocol – “moved laterally [TA0008] via Remote Desktop Protocol [T1021.001] to multiple other hosts.”
- [T1573.001] Encrypted Channel – “The inbound and outbound communications are encrypted with a 128-bit key [T1573.001].”
- [T1090] Proxy – “C2 tunneling proxy [T1090], allowing a remote operator to pivot to other systems.”
- [T1105] Ingress Tool Transfer – “The embedded executables belong to the same malware family … and provide C2 capabilities to a remote operator.”
- [T1071.001] Web Protocols – “Application Layer Protocol: Web Protocols [T1071.001]”
- [T1560.001] Archive Collected Data – “Archive Collected Data: Archive via Utility [T1560.001].”
Indicators of Compromise
- [IP Address] context – 104.223.34[.]198, 92.222.241[.]76
- [IP Address] context – 109.248.150[.]13, 104.155.149[.]103
- [IP Address] context – 134.119.177[.]107, 162.245.190[.]203
- [IP Address] context – 155.94.211[.]207, 185.136.163[.]104
- [File Name] context – hmsvc.exe, 658_dump_64.exe
- [File Name] context – SvcEdge.exe, f7_dump_64.exe, odbccads.exe, praiser.exe, fontdrvhosts.exe, winds.exe
- [File Name] context – error_401.jsp, newdev.dll
- [Network Port] context – 192.95.20[.]8:4443, 192.95.20[.]8:80, 1389
- [Additional IOC] context – 104.223.34[.]198:443
Read more: https://www.cisa.gov/uscert/ncas/alerts/aa22-174a