Ransomware group exploits Citrix NetScaler systems for initial access

A known threat actor specializing in ransomware attacks is believed to be behind a recent campaign that targeted unpatched internet-facing Citrix NetScaler systems to serve as an initial foothold into enterprise networks. “Our data indicates strong similarity between attacks using CVE-2023-3519 and previous attacks using a number of the same TTPs,” Sophos researchers shared. Citrix systems under attack In mid-July 2023, a zero-day remote code execution (RCE) vulnerability (CVE-2023-3519) started getting exploited in the wild. … More →

The post …

access actor attacks campaign citrix citrix netscaler cve cve-2023-3519 data don't miss enterprise enterprise networks exploit exploits facing hot stuff initial access internet netscaler networks ransomware ransomware attacks ransomware group similarity sophos systems threat threat actor ttps unpatched vulnerability