Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Ransomware hackers target major Citrix NetScaler flaw

A blue color image of a person trying to log into a protected laptop.

Cybersecurity researchers from Sophos have discovered a new hacking campaign in which the threat actors leveraged a known vulnerability to conduct domain-wide attacks. 

According to the researchers’ report, a group called 'STAC4663' managed to exploit CVE-2023-3519 to infiltrate vulnerable systems and deploy all sorts of malicious software. The exploit is a remote code execution vulnerability discovered earlier this summer in Citrix NetScaler systems. 

Citrix released a patch for the flaw in mid-July this year however Sophos' report has found not all organizations have applied the patch, leaving their systems vulnerable to malicious third-party penetration. 

Now, Sophos is warning that simply patching the endpoints will not suffice - organizations will also need to thoroughly inspect their networks and endpoints for signs of potential compromise. To do that, businesses should analyze historical data and look for identified Indicators of Compromise (IoC), which can be found here.  

The researchers also said that their findings “align closely” with the report published by Fox-IT earlier this month. In this report, the researchers said they found some 2,000 Citrix NetScaler systems compromised due to CVE-2023-3519.

On the day the report was published (August 14), Fox-IT said 1,828 NetScaler servers were compromised, despite the fact that 1,248 were previously patched against the flaw. “A patched NetScaler can still contain a backdoor,” the researchers explained. “It is recommended to perform an Indicator of Compromise check on your NetScalers, regardless of when the patch was applied.” 

The threat actor being attributed with this campaign - STAC4663 - is being linked to FIN8, BleepingComputer reports. 

FIN8 is being described as a financially-motivated threat actor, active since at least early 2016. It is also known as Syssphinx, and usually targets businesses in retail, hospitality, healthcare, and entertainment verticals. Its attacks often end with ransomware, as the group was seen deploying different encryptors, including BlackCat.

Via: Infosecurity Magazine

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.