Unpatched Citrix NetScaler systems exposed to the internet are being targeted by unknown threat actors in what’s suspected to be a ransomware attack.
Cybersecurity company Sophos is tracking the activity cluster under the moniker STAC4663.
Attack chains involve the exploitation of CVE-2023-3519, a critical code injection vulnerability impacting NetScaler ADC and Gateway servers that could facilitate unauthenticated remote code execution.
Sophos said the modus operandi aligns “closely” with that of an attack campaign that NCC Group Fox-IT disclosed earlier this month in which nearly 2,000 Citrix NetScaler systems were breached.
The attacks are also said to be linked to an earlier incident that used the same techniques minus the Citrix vulnerability. Indicators of compromise (IoCs) associated with the campaign can be accessed here.
The development comes as ransomware is on track to scale new highs in 2023, as threat actors are rapidly escalating their attacks by harnessing security flaws in widely used software to breach target environments.
This has been accompanied by a surge in cybercrime groups spawning personalized ransomware strains (e.g., DoDo, Proton, and Trash Panda) as well as moving more quickly to compromise companies once they have gained initial access, an indication that the attackers are getting better at honing their process of stealing and encrypting data.
While most ransomware gangs continue to pursue double or triple extortion schemes, some groups have been observed pivoting from encryption to a simpler theft-and-extortion strategy, which is referred to as an encryptionless extortion attack.
Source: https://thehackernews.com/
