log4shell exploited infect vmware horizon servers

The rootkit will also tamper with the registry to stop malicious processes from being terminated, and a callback is generated to disguise newly-created processes from utilities including Task Manager. The latest supported build is Windows 10 Creators Update (Redstone 2).ĭrivers are implemented to hide malicious objects from existing security systems. For this reason, it relies on specific OS builds as otherwise, it may cause the infected machine to crash.” “The rootkit uses Direct Kernel Object Modification (DKOM), which involves undocumented kernel structures and objects, for its operations.

“It then checks the operating system version,” the researchers say. In Deep Panda’s case, the new rootkit, dubbed Fire Chili, is designed to keep activities under the radar and is deployed alongside the Milestone backdoor.įire Chili has been signed with a stolen digital certificate - the same used by Winnti to sign-off malicious tools - and will check to ensure the victim machine is not running in safe mode. There may also be affiliation to Winnti, a separate Chinese group known to target game developers and vendors.Ī new campaign detected by FortiGuard Labs researchers is the work of Deep Panda, which is targeting organizations in the finance, travel, and cosmetic industries.ĭuring the past month, FortiGuard has detected the group’s active exploitation of Log4Shell, a critical vulnerability in the Apache Log4J Java logging library ( CVE-2021-44228, CVSS 10.0), to spread a new, “novel” rootkit.Īttackers from various groups use Log4Shell to compromise VMware Horizon servers for data exfiltration and cryptojacking. The cyberattackers have a wide range of malicious tools, including the Milestone backdoor and the Infoadmin Remote Access Trojan (RAT) based on Gh0st RAT code. The APT targets government, defense, healthcare, telecoms, and financial organizations, to name a few, for purposes including data theft and surveillance.

Deep Panda has launched new attacks this month that exploit Log4Shell to deploy the new Fire Chili rootkit.ĭeep Panda is a Chinese advanced persistent threat (APT) hacking group that has been active for at least a decade.

Log4shell exploited infect vmware horizon servers