Iran-linked TunnelVision APT is actively exploiting the Log4j vulnerability

Iran-linked TunnelVision APT group is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers.

Researchers from SentinelOne have observed the potentially destructive Iran-linked APT group TunnelVision is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers.

TunnelVision’s TTPs overlap with the ones associated with Iran-linked nation-state actors Phosphorus, Charming Kitten and Nemesis Kitten. The TunnelVision group heavily leverages 1-day vulnerabilities in its campaigns.

During the time SentinelOne experts monitored the activity of the group, the state-sponsored hackers exploited several flaws, including Fortinet FortiOS (CVE-2018-13379), Microsoft Exchange (ProxyShell) and recently Log4Shell. In almost all the attacks, the threat actors deployed a tunneling tool, such as Fast Reverse Proxy Client (FRPC) and Plink, wrapped in a unique fashion.

“TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.” reads the analysis published by SentinelOne. “Typically, the threat actor initially exploits the Log4j vulnerability to run PowerShell commands directly, and then runs further commands by means of PS reverse shells, executed via the Tomcat process.”

The threat actors leverage the Log4Shell issue in VMware Horizon to run PowerShell commands, sending outputs back utilizing a webhook.

The attackers used PowerShell commands to download tools like Ngrok and run further commands to establish reverse shells and drop a PowerShell backdoor used to gather credentials and perform lateral movements.

The researcher noticed that a dropped executable contains an obfuscated version of a reverse shell which is similar to PowerLess backdoor employed by the Iran-linked APT group APT35 (aka ‘Charming Kitten‘, ‘Phosphorus‘, Newscaster, and Ajax Security Team) in a recent wave of attacks.

Experts also reported that the threat actor utilized a github repository “VmWareHorizon” associated with an account named “protections20” which is owned by the nation-state actor.

“We track this cluster separately under the name “TunnelVision”. This does not imply we believe they are necessarily unrelated, only that there is at present insufficient data to treat them as identical to any of the aforementioned attributions.” concludes the report that also includes Indicators of Compromise (IoCs).

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, TunnelVision)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.