UK’s NHS warns of cyber threats using Log4Shell vulnerability in VMware servers

A report by the United Kingdom’s National Health Service is warning of threats leveraging Log4Shell vulnerability in VMware Horizon servers by an unknown cyber actor. The NHS said the attacks are designed to establish persistence with affective networks, likely as part of a reconnaissance phase. In doing so, the attackers use the Java Naming and Directory Interface via Log4Shell payloads to call back to malicious infrastructure. Once weaknesses are identified, the attack uses the Lightweight Directory Access Protocol to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service.