You're listening to the CyberWire Network, powered by N2K.

This is a CISA cybersecurity alert.

ID number Alpha Alpha 22 TAC 174 Alpha.

Original release date, June 23rd, 2022.

CISA and the U.S. Coast Guard Cyber Command are releasing this joint advisory

to warn network defenders that cyber threat actors,

including state-sponsored APT actors, have continued to exploit the Log4 Shell vulnerability

in VMware Horizon and Unified Access Gateway servers to obtain initial access to organizations that did not apply

available patches or workarounds.

Log4 Shell is a remote code execution vulnerability affecting the Apache Log4J

library and a variety of products such

as consumer and enterprise services, websites, applications, certain versions of

VMware Horizon and Unified Access Gateway servers.

The vulnerability enables malicious cyber actors to submit a specially crafted request to a vulnerable

system.

The request allows the malicious actors to take full control of the affected system.

VMware made fixes available in December 2021.

Since then, multiple threat actor groups have exploited Log4 Shell on unpatched public facing

VMware Horizon and Unified Access Gateway servers.

As a part of this exploitation, suspected APT actors implanted loader malware on compromise systems

with embedded executables, enabling remote command and control.

In one confirmed compromise, these APT actors were able to move laterally inside the network,

...