How LockBit used Citrix Bleed to breach Boeing and other targets
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts. | 7.5 | 100% | KEV ransomware |
| masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal… |
Full article440 words · extracted from helpnetsecurity.com · click to collapse
CVE-2023-4966, aka “Citrix Bleed”, has been exploited by LockBit 3.0 affiliates to breach Boeing’s parts and distribution business, and “other trusted third parties have observed similar activity impacting their organization,” cybersecurity and law enforcement officials have confirmed on Tuesday.
In a joint cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and officials from the Australian Cyber Security Center (ACSC) have shared the tactics, techniques, and procedures and indicators of compromise (IoCs) shared by Boeing and gleaned from other investigations.
“Due to the ease of exploitation, CISA and the authoring organizations expect to see widespread exploitation of the Citrix vulnerability in unpatched software services throughout both private and public networks,” the agencies warned.
Breached by LockBit via Citrix Bleed
CVE-2023-4966 has been patched by Netscaler in early October 2023 and mass exploitation began by the end of the month. It has also been revealed that it had been exploited as a zero-day since August 2023.
Citrix Bleed is an extremely easy to exploit flaw that allows attackers to bypass password and multi-factor authentication requirements on vulnerable Citrix’s NetScaler web application delivery control (ADC) and NetScaler Gateway appliances by hijacking existing authenticated sessions.
As previously noted by security researcher Kevin Beaumont, LockBit attackers leverage this temporary access to set up permanent access by deploying remote access tools such as Altera, Anydesk, TeamViewer, Action1, and others.
Once persistence is established, the attackers find ways to acquire elevated permissions to harvest credentials, move laterally, and access data and resources, and deploy ransomware.
The advisory contains a slew of IoCs – IP addresses, domains, (PowerShell) scripts, tools, scheduled tasks, commands and filenames – that organizations can look for to discover whether they are among LockBit’s victims. It also offers guidance for threat hunters and advice for thorough incident response.
Plan for the future
We’ve known for a while that Citrix Bleed is being leveraged by a variety of threat actors, including ransomware gangs. LockBit is just the most prominent one since its affiliates often target high-profile targets.
Beaumont revealed that, along Boeing, law firm Allen & Overy, the Industrial and Commercial Bank of China (ICBC), and Australian shipping company DP World are among their victims (via Citrix Bleed).
“Know your network boundary and risky products as well as LockBit do,” he advised.
“You need to be able to identify and patch something like CitrixBleed within 24 hours — if you cannot, there is a very real possibility it isn’t the ideal product fit for your organisation due to the level of risk it poses, and you need to rethink if the architecture of your house is fit for purpose.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/11/22/lockbit-citrix-bleed/