Log4Shell Exploitation Persisted in Unpatched VMware Horizon and Broadly Drove Detection Efforts

Threat actors, including suspected state-sponsored groups, continued exploiting Log4Shell (CVE-2021-44228) in unpatched public-facing VMware Horizon and Unified Access Gateway systems, according to a joint CISA and U.S. Coast Guard Cyber Command advisory. In confirmed incidents, attackers used the flaw for initial access, deployed malware disguised as SysInternals tools, established command-and-control, moved laterally over RDP, and in at least one case reached a disaster recovery network and exfiltrated sensitive data. The advisory highlighted artifacts including hmsvc.exe, SvcEdge.exe, odbccads.exe, praiser.exe, fontdrvhosts.exe, winds.exe, error_401.jsp, and newdev.dll, and urged organizations that delayed patching to assume compromise, isolate affected hosts, hunt for indicators, and upgrade to fixed VMware builds.

The vulnerability’s broad reach and difficult-to-observe execution paths also drove a wave of defensive tooling and monitoring guidance across the security community. Researchers released a Burp Suite Log4Shell Scanner that uses out-of-band DNS and LDAP-based callbacks to uncover hidden or asynchronous vulnerable services, while others published Suricata detection coverage, regex-based IOC matching for log review, and updated enterprise advisories from vendors including Red Hat, Sophos, Mandiant, and SANS. Reports also indicated exploitation activity had begun early, with botnets attempting to weaponize the flaw soon after disclosure, reinforcing that Log4Shell remained both a mass-scanning target and a high-impact intrusion vector long after patches became available.