This IP address uses a self-signed certificate CN: WIN-P9NRMH5G6M8. These actors are connected to known malicious IP address 104.223.34198. “After obtaining access, some actors implanted loader malware on compromised systems with embedded executables enabling remote C2. The advisory said that since December, multiple cyber hacker groups had exploited Log4Shell on unpatched, public-facing VMware Horizon and UAG servers to obtain initial access to networks. The data comes from two related incident response engagements and malware analysis of samples discovered on the victims’ networks. The CISA-CGCYBER advisory provides the suspected APT hackers’ tactics, techniques, and procedures (TTPs), information on the loader malware, and indicators of compromise (IOCs). The research revealed that “since the issues uncovered are the result of insecure design practices affecting core system functionality, many of them will remain unpatched in production environments for a significant amount of time.” The OT:ICEFALL issues primarily affect level 1 and 2 devices and could be used in OT-specific attacks targeting those devices.

Unpatched systems exploited by hackers also surfaced in Forescout’s research this week that disclosed the presence of 56 vulnerabilities caused by insecure-by-design practices called OT:ICEFALL, affecting devices from ten OT (operational technology) vendors. In one confirmed compromise, these APT actors were able to move laterally inside the network, gain access to a disaster recovery network, and collect and exfiltrate sensitive data,” it added.

“As part of this exploitation, suspected APT actors implanted loader malware on compromised systems with embedded executables enabling remote command and control (C2). “Since December 2021, multiple threat actor groups have exploited Log4Shell on unpatched, public-facing VMware Horizon and UAG servers,” according to a joint Cybersecurity Advisory issued on Thursday.

Additionally, cybercriminals breached these loopholes to obtain initial access to organizations that did not apply available patches or workarounds. Cybersecurity and Infrastructure Security Agency (CISA) and the Coast Guard Cyber Command (CGCYBER) said that cyber hackers, including state-sponsored advanced persistent threat (APT) hackers, have continued to exploit CVE-2021-44228 ( Log4Shell) in VMware Horizon and Unified Access Gateway (UAG) servers.

Vmware horizon servers are exploit by