Citrix Vulnerability Case Study
In this incident our SOC Cyber Analysts on shift detected internal systems downloading malicious payloads from external sources, prompting the team to engage our customer about the activity. The malicious infrastructure was added to our global deny list and the SOC Incident Handling team was quickly engaged to provide containment and remediation recommendations, including resetting multiple compromised accounts, blocking malicious IP addresses on the firewalls, and isolating impacted systems.
The customer actioned SOC recommendations while the Incident Handling team continued their investigation where the attack source was traced to a threat actor-controlled host connected to the corporate VPN.
After containment actions were taken, the Incident Handling team joined a call with the customer. The root cause was identified as the Citrix vulnerability tracked in CVE-2023-4966, and the customer proceeded to rebuild vulnerable systems with patched software in accordance with Citrix advisories. As a continuation of the efforts, the Incident Handler requested logs and identified additional threat actor details, and searched for evidence of data exfiltration and confirmed that none was identified.
Ultimately, the actions taken by our SOC in this situation and other daily attacks ensure our 2000+ customers are protected from business disruption.
COLLAPSE -
