Those services include: transfer.sh,, webhook.site, ufile.io, and. The hackers use multiple legitimate services to achieve and obscure their activities. Once it's installed, TunnelVision members use it to: Execute reconnaissance commands Create a backdoor user and adding it to the network administrators group Harvest credentials using ProcDump, SAM hive dumps, and comsvcs MiniDump and Download and run tunneling tools, including Plink and Ngrok, which are used to tunnel remote desktop protocol traffic. The PowerShell used here appears to be a variant of this publicly available one. Once installed, a shell allows the hackers to remotely execute commands of their choice on exploited networks. The SentinelOne research shows that the targeting continues and that this time the target is organizations running VMware Horizon, a desktop and app virtualization product that runs on Windows, macOS, and Linux.Īpache Tomcat is an open source Web server that VMware and other enterprise software use to deploy and serve Java-based Web apps. Vulnerabilities in Fortinet FortiOS (CVE-2018-13379) and Microsoft Exchange (ProxyShell) are two of the group's better-known targets. In the past, TunnelVision has exploited so-called 1-day vulnerabilities - meaning vulnerabilities that have been recently patched - to hack organizations that have yet to install the fix. The name is meant to emphasize TunnelVision's heavy reliance on tunneling tools and the unique way it deploys them. Security firm SentinelOne has dubbed the group TunnelVision.

An anonymous reader quotes a report from Ars Technica: Hackers aligned with the government of Iran are exploiting the critical Log4j vulnerability to infect unpatched VMware users with ransomware, researchers said on Thursday.

Vmware horizon hackers are under active