A joint security alert by CISA and the FBI has warned organizations that haven't applied much-needed Log4j security patches and mitigations to VMware Horizon server instances to assume their network has been compromised and act accordingly.  

It comes following an investigation into a cyberattack, against what they describe as a 'federal civilian executive branch' organization, found that hackers breached the network by exploiting an unpatched Log4j vulnerability in a VMware Horizon server. 

The warning comes almost a full year after the Log4j vulnerability was first disclosed and organizations were urged to apply patches or mitigations against a cybersecurity flaw that CISA chief Jen Easterly described as "one of the most serious that I've seen in my entire career, if not the most serious". 

Security

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next

The vulnerability (CVE-2021-44228) is in the widely used Java logging library Apache Log4j and, if successfully exploited, the flaw allows attackers to remotely execute code and gain access to machines. 

Also: The scary future of the internet: How the tech of tomorrow will pose even bigger cybersecurity threats

The ubiquitous nature of Apache Log4j means it's embedded in a vast array of applications, services and enterprise software tools that are written in Java and used by organizations around the world, many of which rushed to apply the fixes. 

But despite the urgent messaging around the need to apply critical security updates, there are still organizations that haven't done so -meaning they're still vulnerable to any cyber criminals or other malicious hackers looking to exploit Log4j. 

Now CISA and the FBI have warned organizations with affected VMware systems that didn't immediately apply patches or workarounds "to assume compromise and initiate threat hunting activities". 

The cybersecurity advisory (CSA) also warns any organizations that detect a compromise as a result of Log4j to "assume lateral movement" by the attackers, investigate any connected systems and audit accounts with high privilege access. 

"All organizations, regardless of identified evidence of compromise, should apply the recommendations in the mitigations section of this CSA to protect against similar malicious cyber activity," said the alert. 

These mitigations include updating affected VMware Horizon and unified access gateway systems and all other software to the latest version, and minimizing the internet-facing attack service by hosting essential services on segregated networks and ensuring strict perimeter access controls are in place, including the use of strong passwords and multi-factor authentication. 

It's also recommended that organizations test their security controls, particularly against the tactics, techniques, and procedures (TTPs) used by Log4j attackers. 

CISA said it had found in this instance that attackers breached the network by exploiting the Log4j vulnerability in an unpatched VMware Horizon server. As well as installing cryptomining malware, the attackers were able to move around the network and stole usernames and passwords. 

CISA has concluded that, in this instance, the malicious cyber activity abusing Log4jwas conducted by an advanced persistent threat (APT) group working on behalf of the Iranian government.

MORE ON CYBERSECURITY

• Log4j flaw: Why it will still be causing problems a decade from now
• Cybersecurity: These are the new things to worry about in 2023
• Within hours of the Log4j flaw being revealed, these hackers were using it
• NSA, FBI warning: Beware these 20 software flaws most used by hackers
• Hackers used the Log4j flaw to gain access before moving across a company's network, say security researchers