Scans for VMWare Hybrid Cloud Extension (HCX) API (Log4j – not brute forcing), (Wed, Mar 12th)

Today, I noticed increased scans for the VMWare Hyprid Cloud Extension (HCX) “sessions” endpoint. These endpoints are sometimes associated with exploit attempts for various VMWare vulnerabilities to determine if the system is running the extensions or to gather additional information to aid exploitation.

This article has been indexed from SANS Internet Storm Center, InfoCON: green

Read the original article: