# Iranian APT exploits Log4Shell in VMware Horizon, deploys XMRig and Ngrok

Published: 2026-03-10 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/80f50020-8398-59cf-b35c-f962ff0bcf22/iranian-apt-exploits-log4shell-in-vmware-horizon-deploys-xmrig-and-ngrok

> Iranian government-sponsored APT compromised a federal network via unpatched Log4Shell in VMware Horizon, installing crypto miners and reverse proxies for persistence.

Between February and July 2022, Iranian government-sponsored APT actors exploited CVE-2021-44228 (Log4Shell) in an unpatched VMware Horizon server at a Federal Civilian Executive Branch organization to gain initial access with administrator-level privileges. The attackers downloaded and installed XMRig cryptocurrency mining software configured with malicious drivers and scheduled tasks, then moved laterally to the domain controller using the built-in DefaultAccount and RDP, harvested credentials with Mimikatz, and created rogue domain administrator accounts.

To maintain persistence and evade detection, the actors deployed Ngrok reverse proxies across multiple hosts, allowing them to tunnel RDP sessions over HTTPS to attacker-controlled domains while bypassing firewall controls. They also disabled Windows Defender via GUI and changed local administrator passwords on multiple hosts as a backup access method. CISA and FBI assess this activity as confirmed Iranian government-sponsored APT compromise and recommend all organizations with unpatched VMware Horizon systems assume breach, conduct threat hunting, and audit domain controllers and privileged accounts.

The advisory provides detailed indicators of compromise, attack chain analysis, and comprehensive mitigation guidance including immediate patching or workarounds for Log4Shell, credential protection hardening, network segmentation, and detection strategies for the observed TTPs.

## Mentioned in this report

- Vulnerabilities: CVE-2021-44228 (KEV)
- Threat actors: Iran-nexus activity (unattributed)
- Malware: Mimikatz, XMRIG, ngrok

## Detection guidance (public sample)

### VMware Horizon Tomcat Service Spawning Shell or PowerShell

ATT&CK: T1190

Detects the VMware Horizon Tomcat service (ws_TomcatService.exe) spawning cmd/PowerShell, consistent with Log4Shell exploitation of Horizon and follow-on PowerShell execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VMware Horizon Tomcat Service Spawning Shell or PowerShell
id: 92811a5b-6c5d-5b26-804f-db2965ba53d6
status: experimental
description: Detects the VMware Horizon Tomcat service (ws_TomcatService.exe) spawning
  a command shell or PowerShell. This is consistent with Log4Shell (CVE-2021-44228)
  exploitation of Horizon servers followed by PowerShell-based tool download and execution.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ws_TomcatService.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
  condition: selection
falsepositives:
- Rare administrative troubleshooting scripts launched through the Horizon Tomcat
  service
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a
```

### Ngrok Tunnel Established for TCP or RDP Forwarding

ATT&CK: T1090

Detects ngrok executed to forward raw TCP (such as RDP port 3389), as used by the actors to tunnel RDP over HTTPS past firewalls. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ngrok Tunnel Established for TCP or RDP Forwarding
id: b9e6e057-ea75-527c-8139-ae867178869c
status: experimental
description: Detects ngrok being run to create a TCP tunnel, particularly forwarding
  RDP (3389). Attackers use ngrok reverse proxies to tunnel RDP sessions over HTTPS
  and bypass firewall controls. Matches on binary name with tcp subcommand, or ngrok
  with tcp 3389 on the command line, not on specific domains.
tags:
- attack.command-and-control
- attack.t1090
- attack.lateral-movement
- attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith: \ngrok.exe
    CommandLine|contains: ' tcp '
  selection_cmdline:
    CommandLine|contains|all:
    - ngrok
    - tcp
    - '3389'
  condition: 1 of selection_*
falsepositives:
- Developers legitimately using ngrok to expose local TCP services for testing
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a
```

### Domain Admin Group Membership Added via Net Command

ATT&CK: T1136.002

Detects net.exe/net1.exe adding a user to a privileged domain group, matching creation of rogue domain administrator accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Domain Admin Group Membership Added via Net Command
id: a2646a18-da4f-5989-a751-20d13c81f5e1
status: experimental
description: Detects net.exe or net1.exe adding an account to a privileged domain
  group (Domain Admins or Enterprise Admins) with /add /domain. Matches the creation
  of rogue domain administrator accounts after lateral movement to a domain controller.
tags:
- attack.persistence
- attack.t1136.002
- attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_cli:
    CommandLine|contains|all:
    - group
    - admins
    - /add
    - /domain
  condition: selection_img and selection_cli
falsepositives:
- Legitimate administrators scripting privileged group changes during onboarding
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/80f50020-8398-59cf-b35c-f962ff0bcf22/iranian-apt-exploits-log4shell-in-vmware-horizon-deploys-xmrig-and-ngrok.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup