Loading story…
Chinese espionage group Deep Panda was linked to an opportunistic campaign that exploited the Log4Shell vulnerability on VMware Horizon servers to compromise organizations in finance, academia, cosmetics, and travel across multiple countries. Investigators said the attackers used PowerShell after initial access to fetch a script chain that installed Milestone, a DLL backdoor derived from leaked Gh0st RAT/Netbot Attacker code, for command-and-control and data theft.
Fortinet’s forensic analysis also identified a previously unknown Windows kernel rootkit named Fire Chili, deployed to hide malicious files, processes, registry keys, and network connections and signed with stolen code-signing certificates from game developers. The intrusion chain included DLL side-loading through a legitimate Synaptics-signed executable and installation of the crtsys.sys driver as a service, while attribution was supported by overlaps with Deep Panda’s historical Infoadmin RAT activity and infrastructure tied to Winnti, including the domain gnisoft[.]com.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Starting January 1, 2022, the cybersecurity community reported active attempts to exploit VMware Horizon through the Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. The activity abused Horizon's embedded Apache Tomcat service for initial access.
Fortinet reported collecting four Fire Chili kernel driver samples that were compiled in early August 2017 and again about ten days later, indicating the malware family's development period.
CrowdStrike identified and named the Chinese intrusion group Deep Panda, describing it as one of the most advanced Chinese nation-state cyber intrusion groups.
Fortinet's FortiGuard Labs released research detailing the VMware Horizon intrusion chain, the Milestone backdoor, and the novel Fire Chili rootkit, and attributed the activity to Deep Panda while noting overlaps with Winnti-linked tradecraft and infrastructure.
Over the month preceding Fortinet's report, Deep Panda was observed opportunistically exploiting Log4Shell in vulnerable VMware Horizon servers across multiple countries and sectors including finance, academia, cosmetics, and travel. The campaign deployed the Milestone backdoor and the Fire Chili rootkit to steal sensitive information.
VMware published KB 87073 with temporary mitigations for CVE-2021-44228 and CVE-2021-45046 affecting Horizon components, including manual steps and Windows/Linux scripts to remove the JndiLookup class and disable risky Log4j behavior. The guidance emphasized that installing a fixed build was strongly recommended over relying on temporary mitigations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 104 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
cynet.com
Open sourcekb.vmware.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourcethehackernews.com
Open sourcefortinet.com
Open sourceattack.mitre.org
Open sourcesecureworks.com
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026
Threat actors, including suspected state-sponsored groups, continued exploiting **Log4Shell** (`CVE-2021-44228`) in unpatched public-facing **VMware Horizon** and **Unified Access Gateway** systems, according to a joint CISA and U.S. Coast Guard Cyber Command advisory. In confirmed incidents, attackers used the flaw for initial access, deployed malware disguised as SysInternals tools, established command-and-control, moved laterally over RDP, and in at least one case reached a disaster recovery network and exfiltrated sensitive data. The advisory highlighted artifacts including `hmsvc.exe`, `SvcEdge.exe`, `odbccads.exe`, `praiser.exe`, `fontdrvhosts.exe`, `winds.exe`, `error_401.jsp`, and `newdev.dll`, and urged organizations that delayed patching to assume compromise, isolate affected hosts, hunt for indicators, and upgrade to fixed VMware builds. The vulnerability’s broad reach and difficult-to-observe execution paths also drove a wave of defensive tooling and monitoring guidance across the security community. Researchers released a Burp Suite **Log4Shell Scanner** that uses out-of-band DNS and LDAP-based callbacks to uncover hidden or asynchronous vulnerable services, while others published **Suricata** detection coverage, regex-based IOC matching for log review, and updated enterprise advisories from vendors including Red Hat, Sophos, Mandiant, and SANS. Reports also indicated exploitation activity had begun early, with botnets attempting to weaponize the flaw soon after disclosure, reinforcing that Log4Shell remained both a mass-scanning target and a high-impact intrusion vector long after patches became available.
Aug 28, 2026
Attackers continued to exploit **Log4Shell** (`CVE-2021-44228`) well after its disclosure, using crafted JNDI payloads over `LDAP`, `RMI`, and `DNS` to gain remote code execution, leak data, and establish initial access on vulnerable Java applications. Security reporting and vendor guidance showed sustained abuse against internet-facing and internal systems, including **VMware Horizon** and other VMware products, while mass scanning also targeted broadly deployed services such as **Elasticsearch 5** and **OpenNMS**. Sophos and Google observed exploit traffic at very high volume, ranging from reconnaissance and proof-of-concept probes to cryptominer deployment, botnet activity tied to **Kinsing**, **Mirai**, and **Tsunami**, credential theft attempts, and follow-on post-compromise tooling. Research and incident guidance indicated the risk persisted because vulnerable Log4j components remained embedded in legacy and third-party software, and because JNDI injection could still be weaponized quickly even where newer Java protections reduced some remote class-loading paths. Horizon3 reported successful exploitation in **23.5%** of assessed internal environments in early 2022 and demonstrated unauthenticated attack paths in products including **VMware Site Recovery Manager 8.3.0**, while CISA warned that malicious actors were actively exploiting Log4Shell in VMware Horizon systems. Defenders were urged to prioritize upgrades to safe Log4j releases, apply VMware advisories, inventory indirect dependencies, and monitor for outbound lookup traffic, remote execution, persistence, and lateral movement after initial compromise.
Aug 15, 2026