Loading story…
An Iran-linked threat actor assessed as TunnelVision exploited the Log4Shell vulnerability (CVE-2021-44228) in VMware Horizon to compromise a U.S. federal civilian agency, according to reporting that ties the activity to broader Iranian intrusion operations. Researchers said the intrusion matched a campaign previously observed in the wild and aligned with government warnings that Iranian operators were actively abusing the flaw in internet-facing Horizon systems.
The intrusion reportedly began from 51.89.181[.]64 and involved follow-on communication with 182.54.217[.]2 and us-nation-ny[.]cf, followed by PowerShell payload delivery, XMRig cryptomining, Ngrok tunneling, lateral movement over RDP, credential harvesting, and the creation of a new domain administrator account. SecurityScorecard assessed with moderate confidence that TunnelVision was responsible based on infrastructure and tradecraft overlaps, while Microsoft has separately linked related Iranian ransomware activity to DEV-0270 / PHOSPHORUS, reinforcing the view that the operation fits within a broader Iran-aligned threat cluster despite ongoing attribution ambiguity among groups such as Charming Kitten and Nemesis Kitten.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
SecurityScorecard analyzed the advisory's indicators and assessed with moderate confidence that TunnelVision was responsible for the intrusion. It cited overlaps in infrastructure and tradecraft with the February 2022 VMware Horizon exploitation and suggested a connection to the broader Iranian cluster Phosphorus.
Microsoft Threat Intelligence published research profiling DEV-0270 and associating its ransomware operations with PHOSPHORUS. The excerpt provides attribution but no additional operational details.
CISA conducted an incident response engagement tied to the federal intrusion during June and July 2022. Investigators found the attackers had exploited a vulnerable VMware Horizon server, used PowerShell payloads, deployed XMRig, used Ngrok and RDP, harvested credentials, and created a new domain administrator account.
A federal intrusion detection system first detected an intrusion into an unspecified Federal Civilian Executive Branch organization. The later advisory said an Iran-linked threat actor had exploited Log4Shell in VMware Horizon during this incident.
A SentinelOne report documented Iranian-aligned threat actor TunnelVision actively exploiting the Log4Shell vulnerability in VMware Horizon. The activity used infrastructure including 182.54.217[.]2 and tradecraft such as PowerShell and Ngrok.
CISA and the FBI issued a joint advisory on November 16 warning that an Iran-linked threat actor was actively exploiting Log4Shell in VMware Horizon. The advisory described the earlier intrusion into a Federal Civilian Executive Branch organization and published related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcemicrosoft.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet reported that an Iranian state-backed threat group maintained a long-running intrusion inside a major critical national infrastructure organization in the Middle East, using stolen VPN credentials for initial access and sustaining operations from at least May 2023 through February 2025, with possible compromise indicators dating back to 2021. Investigators said the attackers focused on espionage and strategic prepositioning rather than ransomware, deploying web shells and backdoors including **Havoc**, **HanifNet**, **HXLibrary**, **NeoExpressRAT**, **SystemBC**, and **MeshCentral**, while harvesting credentials, collecting email, and moving laterally across the environment. The attackers also used proxying and tunneling tools such as **plink**, **Ngrok**, **glider proxy**, and **ReverseSocks5** to bypass segmentation and probe restricted networks tied to virtualization and operational technology, though Fortinet said it found no conclusive evidence that the OT network itself was breached or disrupted. After remediation began in late 2024, the group escalated efforts to retain or regain access through removed web shells, RDP and VPN logins, exploitation of an unpatched **ZKTeco ZKBioTime** server, and phishing sent from compromised third-party email accounts, with Fortinet assessing the activity overlaps tradecraft associated with **Lemon Sandstorm**, **Pioneer Kitten**, and **Fox Kitten**.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026