TunnelVision Exploits 1-Day Vulnerabilities to Unleash Ransomware

In early 2022, an Iranian-aligned threat actor tracked as TunnelVision actively exploited the Log4Shell vulnerability in VMware Horizon servers across the Middle East and the United States. Once inside victim networks, the group deployed backdoors, created hidden administrator accounts, harvested credentials, and moved laterally using tunneling tools. The group has also been linked to ransomware deployment, making it a potentially destructive threat beyond espionage.

SentinelLabs tracks this activity as TunnelVision — an Iranian-aligned threat cluster. Other vendors have linked overlapping activity to Phosphorus (Microsoft), Charming Kitten, or Nemesis Kitten (CrowdStrike). SentinelLabs maintains a separate tracking cluster due to insufficient data to definitively merge TunnelVision with these groups, though behavioral and infrastructure overlaps — particularly with the PowerLess backdoor used by Phosphorus — suggest a close relationship.

The campaign served dual goals: intelligence gathering through credential harvesting and persistent backdoor access, and potential sabotage via ransomware deployment. TunnelVision's consistent focus on gaining deep network access — creating hidden admin accounts, tunneling RDP, and exfiltrating data — suggests the group is positioned for both sustained espionage and disruptive follow-on operations depending on strategic direction from its backers.

The campaign targeted organizations in the Middle East and the United States. TunnelVision's pattern of exploiting widely deployed enterprise software — VMware Horizon, Fortinet FortiOS, Microsoft Exchange — means the potential victim pool spans any organization running unpatched versions of these products. IOC overlaps with a separate report link TunnelVision activity to the US Federal Civilian Executive Branch network, indicating government targets were among those compromised.

Government agencies and technology-dependent organizations running VMware Horizon, Fortinet, or Microsoft Exchange were the primary targets. TunnelVision's attack model is opportunistic within its target regions — it scans for any organization running vulnerable software rather than selecting targets based on sector alone. That said, government, critical infrastructure, and enterprise technology environments running these products are at highest risk.

TunnelVision exploited the Log4Shell vulnerability in VMware Horizon to run PowerShell commands via the server's Tomcat process. From there, attackers deployed two reverse shell variants, downloaded tunneling tools (Plink, Ngrok) to relay RDP traffic, created hidden administrator accounts, and harvested credentials using Procdump and Windows memory dump techniques. A custom backdoor — InteropServices.exe — was then installed as a Windows service to maintain persistence. All C2 traffic was routed through attacker-controlled domains and legitimate web services to blend in with normal traffic.

VMware Horizon, Fortinet FortiOS, and Microsoft Exchange are all widely deployed in enterprise and government environments, making them high-value targets for a threat actor seeking broad access across many organizations simultaneously. TunnelVision's strategy is to exploit these products immediately after patches are released — before organizations can apply them — maximizing the window of opportunity. This 1-day exploitation model requires minimal custom development and delivers access at scale.