“An unknown threat group has been observed targeting VMware Horizon servers running versions affected by Log4Shell vulnerabilities in order to establish persistence within affected networks.” reads the security advisory published by NHS.

The security team at the UK National Health Service (NHS) also announced to have spotted threat actors exploiting the Log4Shell vulnerability to hack VMWare Horizon servers and install web shells. Microsoft Security Intelligence January 11, 2022

'It's likely that we will continue to see criminal groups exploring the opportunities of the Log4Shell vulnerability, so it's an attack vector against which defenders need to exercise constant vigilance,' Lee added.We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing systems running VMWare Horizon. 'When an access broker group takes interest in a vulnerability whose scope is so unknown, it's a good indication that attackers see significant value in its exploitation,' Tony Lee, vice president of global services technical operations at BlackBerry, said. 'The ramifications of this vulnerability are serious for any system, especially ones that accept traffic from the open Internet,' the virtualization services provider cautioned. The onslaught against Horizon servers has also prompted VMware to urge its customers to apply the patches immediately. Earlier this month, Microsoft called out a China-based operator tracked as DEV-0401 for deploying a new ransomware strain called NightSky on the compromised servers. This is far from the first time internet-facing systems running VMware Horizon have come under attack using Log4Shell exploits.

Vmware horizon hackers are under active