Security News > 2023 > August > Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability
Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what's suspected to be a ransomware attack.
Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could facilitate unauthenticated remote code execution.
Sophos said the modus operandi aligns "Closely" with that of an attack campaign that NCC Group Fox-IT disclosed earlier this month in which nearly 2,000 Citrix NetScaler systems were breached.
The attacks are also said to be linked to an earlier incident that used the same techniques minus the Citrix vulnerability.
"All this leads us to say it's probable that this is activity from a known threat actor specializing in ransomware attacks," the company said in a series of posts on X. Users of Citrix NetScaler ADC and Gateway appliances are highly recommended to apply the patches to mitigate potential threats.
The development comes as ransomware is on track to scale new highs in 2023, as threat actors are rapidly escalating their attacks by harnessing security flaws in widely used software to breach target environments.
News URL
https://thehackernews.com/2023/08/citrix-netscaler-alert-ransomware.html
Related news
- Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool (source)
- PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153) (source)
- CISA shares critical infrastructure defense tips against Chinese hackers (source)
- Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability (source)
- US sanctions APT31 hackers behind critical infrastructure attacks (source)
- Ransomware can mean life or death at hospitals. DEF CON hackers to the rescue? (source)
- Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mining (source)
- CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability (source)
- Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks (source)
- Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-07-19 | CVE-2023-3519 | Code Injection vulnerability in Citrix products Unauthenticated remote code execution | 9.8 |