\n<\/p>\n
Security researchers say<\/span> hackers are mass-exploiting a critical-rated vulnerability in Citrix NetScaler systems to launch crippling cyberattacks against big-name organizations worldwide.<\/p>\n These cyberattacks have so far included aerospace giant Boeing<\/a>; the world\u2019s biggest bank, ICBC; one of the world\u2019s largest port operators, DP World; and international law firm Allen & Overy, according to reports.<\/p>\n Thousands of other organizations remain unpatched against the vulnerability, tracked officially as CVE-2023-4966<\/a> and dubbed \u201cCitrixBleed.\u201d The majority of affected systems are located in North America, according to nonprofit threat tracker Shadowserver Foundation<\/a>. The U.S. government\u2019s cybersecurity agency CISA has also sounded the alarm in an advisory urging federal agencies to patch<\/a> against the actively exploited flaw.<\/p>\n Here\u2019s what we know so far.<\/p>\n On October 10, network equipment maker Citrix disclosed the vulnerability affecting on-premise versions of its NetScaler ADC and NetScaler Gateway platforms, which large enterprises and governments use for application delivery and VPN connectivity.<\/p>\n The flaw is described as a sensitive information disclosure vulnerability that allows remote unauthenticated attackers to extract large amounts of data from a vulnerable Citrix device\u2019s memory, including sensitive session tokens (hence the name \u201cCitrixBleed\u201d). The bug requires little effort or complexity to exploit, allowing hackers to hijack and use legitimate session tokens to compromise a victim\u2019s network without needing a password or using two-factor.<\/p>\n Citrix released patches, but a week later on October 17 updated its advisory to advise that it had\u00a0observed exploitation in the wild.<\/p>\n Early victims included professional services, technology and government organizations, according to incident response giant Mandiant<\/a>, which said it began investigating after discovering \u201cmultiple instances of successful exploitation\u201d as early as late-August before Citrix made patches available.<\/p>\n Robert Knapp, head of incident response at cybersecurity firm Rapid7 \u2014 which also began investigating the bug<\/a> after detecting potential exploitation of the bug in a customer\u2019s network \u2014 said the company has also observed attackers targeting organizations across healthcare, manufacturing and retail.<\/p>\n \u201cRapid7 incident responders have observed both lateral movement and data access in the course of our investigations,\u201d said Knapp, suggesting hackers are able to gain broader access to victims\u2019 network and data after initial compromise.<\/p>\n Cybersecurity company ReliaQuest said\u00a0last week<\/a>\u00a0it has evidence that at least four threat groups \u2014 which it did not name \u2014 are leveraging CitrixBleed, with at least one group automating the attack process.<\/p>\n One of the threat actors is believed to be the\u00a0Russia-linked LockBit ransomware gang<\/a>, which has already claimed responsibility for several large-scale breaches believed to be associated with CitrixBleed.<\/p>\n Security researcher Kevin Beaumont wrote in a blog post<\/a> Tuesday that the LockBit gang last week hacked into the U.S. branch of Industrial and Commercial Bank of China (ICBC) \u2014 said to be the world\u2019s largest lender by assets \u2014 by compromising an unpatched Citrix Netscaler box. The outage disrupted the banking giant\u2019s ability to clear trades. According to Bloomberg on Tuesday<\/a>, the firm has yet to restore normal operations.<\/p>\n ICBC, which reportedly paid LockBit\u2019s ransom demand, declined to answer TechCrunch\u2019s questions but said in a statement on its website that it \u201cexperienced a ransomware attack\u201d that \u201cresulted in disruption to certain systems.\u201d<\/p>\n A LockBit representative told Reuters on Monday<\/a> that ICBC \u201cpaid a ransom \u2014 deal closed,\u201d but did not provide evidence of their claim. LockBit also told malware research group\u00a0vx-underground<\/a> that ICBC paid a ransom, but declined to say how much.<\/p>\n Beaumont said in a post on Mastodon<\/a> that Boeing also had an unpatched Citrix Netscaler system at the time of its LockBit breach, citing data from Shodan, a search engine for exposed databases and devices.<\/p>\n Boeing spokesperson Jim Proulx previously told TechCrunch that the company is \u201caware of a cyber incident impacting elements of our parts and distribution business\u201d but would not comment on LockBit\u2019s alleged publication of stolen data.<\/p>\n Allen & Overy, one of the world\u2019s largest law firms, was also running an affected Citrix system at the time of its compromise, Beaumont noted. LockBit added both Boeing and Allen & Overy to its dark web leak site, which ransomware gangs typically use to extort victims by publishing files unless the victims pay a ransom demand<\/a>.<\/p>\n Allen & Overy spokesperson Debbie Spitz confirmed the law firm experienced a \u201cdata incident\u201d and said it was \u201cassessing exactly what data has been impacted, and we are informing affected clients.\u201d<\/p>\n The Medusa ransomware gang is also exploiting CitrixBleed to compromise targeted organizations, said Beaumont<\/a>.<\/p>\n \u201cWe would expect CVE-2023-4966 to be one of the top routinely exploited vulnerabilities from 2023,\u201d Rapid7\u2019s head of vulnerability research Caitlin Condon told TechCrunch.<\/p>\n<\/p><\/div>\nWhat is CitrixBleed?<\/h2>\n
Big-name victims<\/h2>\n