CISA Releases Update to Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells

Summary:

CISA has released an updated Cybersecurity Advisory (CSA) regarding the exploitation of Citrix CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. The updated CSA contains new threat actor tactics, techniques, and procedures (TTPs), as well as indicators of compromise (IOCs), and an additional victim. CISA recommends that critical infrastructure organizations review the advisory and prioritize patching known exploited vulnerabilities, such as Citrix CVE-2023-3519.