Iranian APT exploits Log4Shell in VMware Horizon, deploys XMRig and Ngrok

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Iranian government-sponsored APT compromised a federal network via unpatched Log4Shell in VMware Horizon, installing crypto miners and reverse proxies for persistence.

Between February and July 2022, Iranian government-sponsored APT actors exploited CVE-2021-44228 (Log4Shell) in an unpatched VMware Horizon server at a Federal Civilian Executive Branch organization to gain initial access with administrator-level privileges. The attackers downloaded and installed XMRig cryptocurrency mining software configured with malicious drivers and scheduled tasks, then moved laterally to the domain controller using the built-in DefaultAccount and RDP, harvested credentials with Mimikatz, and created rogue domain administrator accounts.

To maintain persistence and evade detection, the actors deployed Ngrok reverse proxies across multiple hosts, allowing them to tunnel RDP sessions over HTTPS to attacker-controlled domains while bypassing firewall controls. They also disabled Windows Defender via GUI and changed local administrator passwords on multiple hosts as a backup access method. CISA and FBI assess this activity as confirmed Iranian government-sponsored APT compromise and recommend all organizations with unpatched VMware Horizon systems assume breach, conduct threat hunting, and audit domain controllers and privileged accounts.

The advisory provides detailed indicators of compromise, attack chain analysis, and comprehensive mitigation guidance including immediate patching or workarounds for Log4Shell, credential protection hardening, network segmentation, and detection strategies for the observed TTPs.

title: VMware Horizon Tomcat Service Spawning Shell or PowerShell
id: 92811a5b-6c5d-5b26-804f-db2965ba53d6
status: experimental
description: Detects the VMware Horizon Tomcat service (ws_TomcatService.exe) spawning
  a command shell or PowerShell. This is consistent with Log4Shell (CVE-2021-44228)
  exploitation of Horizon servers followed by PowerShell-based tool download and execution.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ws_TomcatService.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
  condition: selection
falsepositives:
- Rare administrative troubleshooting scripts launched through the Horizon Tomcat
  service
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

title: Ngrok Tunnel Established for TCP or RDP Forwarding
id: b9e6e057-ea75-527c-8139-ae867178869c
status: experimental
description: Detects ngrok being run to create a TCP tunnel, particularly forwarding
  RDP (3389). Attackers use ngrok reverse proxies to tunnel RDP sessions over HTTPS
  and bypass firewall controls. Matches on binary name with tcp subcommand, or ngrok
  with tcp 3389 on the command line, not on specific domains.
tags:
- attack.command-and-control
- attack.t1090
- attack.lateral-movement
- attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith: \ngrok.exe
    CommandLine|contains: ' tcp '
  selection_cmdline:
    CommandLine|contains|all:
    - ngrok
    - tcp
    - '3389'
  condition: 1 of selection_*
falsepositives:
- Developers legitimately using ngrok to expose local TCP services for testing
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

title: Domain Admin Group Membership Added via Net Command
id: a2646a18-da4f-5989-a751-20d13c81f5e1
status: experimental
description: Detects net.exe or net1.exe adding an account to a privileged domain
  group (Domain Admins or Enterprise Admins) with /add /domain. Matches the creation
  of rogue domain administrator accounts after lateral movement to a domain controller.
tags:
- attack.persistence
- attack.t1136.002
- attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_cli:
    CommandLine|contains|all:
    - group
    - admins
    - /add
    - /domain
  condition: selection_img and selection_cli
falsepositives:
- Legitimate administrators scripting privileged group changes during onboarding
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a