Threat Advisory: VMware Horizon Servers Actively Being Hit With Cobalt Strike

Huntress confirms mass exploitation of Log4Shell (CVE-2021-44228 / CVE-2021-45046) against internet-facing VMware Horizon servers: their dataset found ~34% of sampled Horizon servers unpatched and ~10% backdoored with a modified absg-worker.js web shell, with exploitation activity observed Dec 25–29, 2021. A subsequent wave delivered Cobalt Strike via a PowerShell downloader (example callback to 185.112.83.116); the report provides detection tips (search for child_process strings, inspect process parentage such as ws_TomcatService.exe spawning PowerShell), mitigation steps (apply VMware patches, run Horizon mitigation tool, restore pre-compromise backups), and recommends incident response if a web shell is found.