Iran-linked TunnelVision APT is actively exploiting the Log4j vulnerability

Iran-linked TunnelVision APT group is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers.

Researchers from SentinelOne have observed the potentially destructive Iran-linked APT group TunnelVision is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers.

TunnelVision’s TTPs overlap with the ones associated with Iran-linked nation-state actors Phosphorus, Charming Kitten and Nemesis Kitten. The TunnelVision group heavily leverages 1-day vulnerabilities in its campaigns.

During the time SentinelOne experts monitored the activity of the group, the state-sponsored hackers exploited several flaws, including Fortinet FortiOS (CVE-2018-13379), Microsoft Exchange (ProxyShell) and recently Log4Shell. In almost all the attacks, the threat actors deployed a tunneling tool, such as Fast Reverse Proxy Client (FRPC) and Plink, wrapped in a unique fashion.

“TunnelVision attackers have been actively exploiting the vulnerability to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.” reads the analysis published by SentinelOne. “Typically, the threat actor initially exploits the Log4j vulnerability to run PowerShell commands directly, and then runs further commands by means of PS reverse shells, executed via the Tomcat process.”

The threat actors leverage the Log4Shell issue in VMware Horizon to run PowerShell commands, sending outputs back utilizing a webhook.

The attackers used PowerShell commands to download tools like Ngrok and run further commands to establish reverse shells and drop a PowerShell backdoor used to gather credentials and perform lateral movements.

The researcher noticed that a dropped executable contains an obfuscated version of a reverse shell which is similar to PowerLess backdoor employed by the Iran-linked APT group APT35 (aka ‘Charming Kitten‘, ‘Phosphorus‘, Newscaster, and Ajax Security Team) in a recent wave of attacks.

Experts also reported that the threat actor utilized a github repository “VmWareHorizon” associated with an account named “protections20” which is owned by the nation-state actor.

“We track this cluster separately under the name “TunnelVision”. This does not imply we believe they are necessarily unrelated, only that there is at present insufficient data to treat them as identical to any of the aforementioned attributions.” concludes the report that also includes Indicators of Compromise (IoCs).

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, TunnelVision)