Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-3519 | Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway CVE-2023-3519 is a critical (CVSS 9.8) unauthenticated remote code execution flaw caused by improper code-injection handling (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker with no credentials can trigger it by sending crafted requests to an appliance configured as a Gateway (VPN/ICA proxy/RDP proxy) or AAA authentication virtual server, gaining arbitrary code execution on the appliance. Exploitation typically yields a foothold behind the VPN edge — access to internal networks, credential theft, and follow-on activity such as espionage or ransomware deployment. Any organization running unpatched NetScaler ADC/Gateway appliances, especially internet-facing remote-access endpoints, is affected; NetScaler is one of the most widely deployed enterprise VPN/ADC platforms. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-07-19 with known ransomware use, EPSS estimates a 99.7% exploitation probability, and researchers have linked activity to China-nexus espionage (Silk Typhoon) and ransomware operations. Do: Immediately upgrade internet-facing NetScaler ADC/Gateway appliances to the fixed builds in Citrix's advisory (14.1-8.50+, 13.1-49.13+, 13.0-82.45+, 12.1-55.300+, including FIPS/NDcPP equivalents) — per CISA KEV, apply these mitigations or discontinue use if patching is unavailable. Confirm whether each appliance is configured as a Gateway or AAA virtual server (only those are affected), and hunt for compromise — unexpected configuration changes, unfamiliar accounts, webshells, or anomalous VPN sessions — rotating credentials on any suspected compromise. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed NetScaler Gateway/ADC appliances (order 10k-100k at disclosure), serving hundreds of thousands to millions of downstream… |
Full article417 words · extracted from thehackernews.com · click to collapse
The Hacker NewsAug 29, 2023Vulnerability / Network Security
Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack.
Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663.
Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could facilitate unauthenticated remote code execution.
In one intrusion detected in mid-August 2023, the security flaw is said to have been used to conduct a domain-wide attack, including injecting payloads into legitimate executables such as the Windows Update Agent (wuauclt.exe) and the Windows Management Instrumentation Provider Service (wmiprvse.exe). An analysis of the payload is underway.
Other notable aspects include the distribution of obfuscated PowerShell scripts, PHP web shells, and the use of an Estonian service called BlueVPS for malware staging.
Sophos said the modus operandi aligns "closely" with that of an attack campaign that NCC Group Fox-IT disclosed earlier this month in which nearly 2,000 Citrix NetScaler systems were breached.
The attacks are also said to be linked to an earlier incident that used the same techniques minus the Citrix vulnerability. Indicators of compromise (IoCs) associated with the campaign can be accessed here.
"All this leads us to say it's probable that this is activity from a known threat actor specializing in ransomware attacks," the company said in a series of posts on X.
Users of Citrix NetScaler ADC and Gateway appliances are highly recommended to apply the patches to mitigate potential threats.
The development comes as ransomware is on track to scale new highs in 2023, as threat actors are rapidly escalating their attacks by harnessing security flaws in widely used software to breach target environments.
This has been accompanied by a surge in cybercrime groups spawning personalized ransomware strains (e.g., DoDo, Proton, and Trash Panda) as well as moving more quickly to compromise companies once they have gained initial access, an indication that the attackers are getting better at honing their process of stealing and encrypting data.
While most ransomware gangs continue to pursue double or triple extortion schemes, some groups have been observed pivoting from encryption to a simpler theft-and-extortion strategy, which is referred to as an encryptionless extortion attack.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/08/citrix-netscaler-alert-ransomware.html