Update: An unknown threat actor is utilizing the Log4Shell vulnerability chain to implant malicious web shells into VMware Horizon servers for future exploitation. With these malicious shells, the threat actor has the capabilities to deploy additional payloads on the system, extract datasets from the system offsite, execute a ransomware attack, and much more. Based on the tactics and techniques of this unknown actor once the Log4Shell vulnerability is exploited, malicious Java code executes a PowerShell script, which was implanted from VMware Horizon’s “ws_TomcatService.exe”. The executed script injects a web shell to “absg-worker.js” and restarts the service entirely. Once completed, a listener is opened and monitors connections from port 8443, awaiting further remote commands from the unknown threat actor. While major threat groups such as Conti are utilizing the Log4Shell vulnerability, additional smaller threat groups or individuals are starting to exploit the vulnerability for their own agendas, allowing for numerous unknown threat actors to test the waters. In addition, the Federal Trade Commission (FTC) has stated that they plan to open legal cases against companies & organizations who neglect to implement patches to project against Log4J/Log4Shell vulnerabilities. CTIX is continuing to monitor Log4J/Log4Shell developments and will provide updates as needed.