Dive Brief:
- Threat researchers said attacks from an initial access broker (IAB) group called Prophet Spider coincide with the recently discovered Log4Shell vulnerability in VMware Horizon, according to Blackberry Research and Intelligence.
- Threat actors primarily installed cryptomining software onto affected systems, however in some cases they deployed Cobalt Strike beacons, according to Blackberry.
- Prophet Spider has a history of compromising networks and selling access to ransomware operators. It has similarities to the threat actor Zebra2104, however the two groups are considered competitors and do not have any known connections to each other, according to Jim Simpson, Blackberry director of threat intelligence.
Dive Insight:
Threat researchers from Microsoft and other security providers previously disclosed efforts by initial access brokers to exploit the Log4j vulnerability, dubbed Log4Shell. IABs typically, acting as the middleman, gain access into a system then sell it to third-party threat actors, almost like brokering access to a home that has been broken into.
Log4j is found in hundreds of millions of devices worldwide and VMware Horizon is a widely used virtual desktop application. The widespread interest by IABs may indicate the long-term potential of exploiting the vulnerability, according to threat researchers.
"When an access broker group takes interest in a vulnerability whose scope is unknown, it's a good indication that attackers see significant value in its exploitation," said Tony Lee, VP of global service technical operations at Blackberry.
The Log4j vulnerability is considered so potentially dangerous because attackers can gain remote access to a compromised environment using just a few simple lines of code. Unlike in other high-profile vulnerabilities, attackers do not need sophisticated engineering backgrounds, nor they do not need authenticated access.
Attacks involving VMware Horizon involve exploitation of the Log4shell vulnerability in Apache Tomcat service, which is embedded in VMware Horizon, according to NHS Digital, which first reported the exploit earlier this month.
"The exploitation activity we have seen is recent," Lee said. "However, since we now have evidence that they have weaponized the exploit and payload delivery, we should expect to see more of the same."
