In a concerning development, cybersecurity experts at IBM have discovered a credential harvesting campaign targeting organizations that have not patched their Citrix NetScaler gateways against a recent vulnerability. These attackers exploit a known vulnerability, tracked as CVE-2023-3519, which has been actively exploited since June 2023. Of particular concern is the fact that some cyberattacks have specifically targeted critical infrastructure organizations.
Exploited Vulnerability
CVE-2023-3519 is a known vulnerability that has been used as an entry point by threat actors. This vulnerability has been exploited for several months, allowing attackers to gain unauthorized access to vulnerable NetScaler instances. Critical infrastructure organizations have been particularly targeted, underscoring the severity of the issue.
Scale of Backdoored Instances
By mid-August, it was discovered that around 2,000 NetScaler instances had been compromised in an automated campaign that took advantage of the CVE-2023-3519 vulnerability. These instances had been backdoored, potentially enabling attackers to gain unauthorized access to sensitive systems and data. Even more concerning is the fact that as of last week, scans still reveal the presence of at least 1,350 compromised NetScaler instances from previous attacks.
New Malicious Campaign
In September, IBM detected a new malicious campaign that focused on targeting unpatched NetScaler devices to steal user credentials. The threat actor behind this campaign exploited the CVE-2023-3519 vulnerability to inject a PHP web shell, modify the legitimate ‘index.html’ file, and load a JavaScript file from their own infrastructure. This technique is designed to deceive users and capture their login credentials.
Data Theft Mechanism
The injected JavaScript code plays a critical role in the illicit data collection process. It discreetly collects the username and password information entered by unsuspecting users and securely sends that data to a remote server controlled by the attacker. This nefarious activity puts organizations at great risk, as sensitive user credentials can be used for unauthorized access and potentially even further exploitation.
Victim Analysis
IBM’s analysis revealed a significant number of victims affected by this credential harvesting campaign. Approximately 600 unique victim IP addresses were identified, most of which were located in the United States and Europe. These victims hosted modified NetScaler Gateway login pages used to deceive users into entering their credentials. Of the scanned instances, at least 285 NetScaler gateways were confirmed to be compromised.
Recommendations for Organizations
In light of this growing threat, it is crucial for organizations to take immediate action to mitigate vulnerabilities and protect their sensitive information. The following steps are recommended:
1. Patch NetScaler Gateways: Organizations should ensure that their NetScaler gateways are promptly updated with the latest security patches, including the specific patch addressing CVE-2023-3519. Regularly updating systems is vital in preventing the exploitation of known vulnerabilities.
2. Change Certificates and Passwords: As part of remediation efforts, organizations should consider updating their SSL/TLS certificates and implementing strong, unique passwords. This will further strengthen the security posture of NetScaler gateways and reduce the risk of unauthorized access.
The credential harvesting campaign targeting unpatched Citrix NetScaler gateways has highlighted the critical importance of promptly addressing known vulnerabilities and maintaining strong security practices. Organizations should prioritize patch management, regularly updating their systems to prevent exploitation. Safeguarding user credentials through robust security measures is crucial to protecting sensitive information and mitigating potential cyber attacks. By implementing these recommendations, organizations can significantly reduce their risk exposure and maintain a secure environment for their operations.