It is critical that we remain vigilant about any exploit, even if it has been checked off the list as ‘done’.”Įrich Kron, security awareness advocate at KnowBe4, added: “Patching is a critical part of any organisation’s security plan, and devices connected to the internet while unpatched, especially against a well-known and exploited vulnerability, create a serious risk for the organisations and their customers. “Vulnerabilities can stay around for a long time and continue to be exploited as long as there are gaps. But there are always servers that get missed, or organisations that don’t keep up with patching.

LogicHub founder and CEO Kumar Saurabh commented: “This vulnerability has followed a typical path – after initial discovery, there was a flurry of patching by security-conscious organisations, and then it dropped out of the news. “If updates or workarounds were not promptly applied following VMware’s release of updates for Log4Shell in December 2021, treat all affected VMware systems as compromised,” CISA said. In at least one known case, an advanced persistent threat (APT) actor was able to move laterally within its victim’s network, gain access to a disaster recovery network, and steal sensitive data. Since that time, it said, multiple groups have exploited Log4Shell on unpatched, public-facing Horizon and UAG servers, usually to implant loader malware with embedded executables enabling remote command and control. In its advisory, the agency said threat actors were, by and large, using Log4Shell as a means to obtain initial access to organisations that did not apply available patches or workarounds when the vulnerability was exposed in December 2021.

Vmware horizon hackers are active by