Ransomware hackers target major Citrix NetScaler flaw
Cybersecurity researchers from Sophos have discovered a new hacking campaign in which the threat actors leveraged a known vulnerability to conduct domain-wide attacks.
According to the researchers’ report, a group called ‘STAC4663’ managed to exploit CVE-2023-3519 to infiltrate vulnerable systems and deploy all sorts of malicious software. The exploit is a remote code execution vulnerability discovered earlier this summer in Citrix NetScaler systems.
Citrix released a patch for the flaw in mid-July this year however Sophos’ report has found not all organizations have applied the patch, leaving their systems vulnerable to malicious third-party penetration.
Links to FIN8
Now, Sophos is warning that simply patching the endpoints will not suffice – organizations will also need to thoroughly inspect their networks and endpoints for signs of potential compromise. To do that, businesses should analyze historical data and look for identified Indicators of Compromise (IoC), which can be found here.
The researchers also said that their findings “align closely” with the report published by Fox-IT earlier this month. In this report, the researchers said they found some 2,000 Citrix NetScaler systems compromised due to CVE-2023-3519.
On the day the report was published (August 14), Fox-IT said 1,828 NetScaler servers were compromised, despite the fact that 1,248 were previously patched against the flaw. “A patched NetScaler can still contain a backdoor,” the researchers explained. “It is recommended to perform an Indicator of Compromise check on your NetScalers, regardless of when the patch was applied.”
The threat actor being attributed with this campaign – STAC4663 – is being linked to FIN8, BleepingComputer reports.
FIN8 is being described as a financially-motivated threat actor, active since at least early 2016. It is also known as Syssphinx, and usually targets businesses in retail, hospitality, healthcare, and entertainment verticals. Its attacks often end with ransomware, as the group was seen deploying different encryptors, including BlackCat.
Here are the best firewalls to keep your business protected
