The security team of the UK National Health Service (NHS) has detected a threat actor using the Log4Shell vulnerability to hack VMWare Horizon servers and plant web shells for future attacks.Log4j patches were released to fix and counter the attacks, and VMWare was one of the companies that integrated the Log4j fixes in its products. But it appears attackers are trying to identify unpatched servers despite VMWare’s attempt to make the patch widely available.The NHS’ security team said that once the exploit has successfully run and the web shell is placed on the vulnerable server, the web shell can act as a backdoor for other malicious activities “such as deploying additional malicious software, data exfiltration, or deployment of ransomware”.