Iranian APT Actors Compromised US Federal Network, Deployed Crypto Miner, Credential Harvester

In February 2022, the threat actors exploited Log4Shell for initial access to the organization’s unpatched VMware Horizon server. As part of their initial exploitation, CISA observed a connection to a known malicious IP address lasting 17.6 seconds.