Citrix, the virtualization solution manufacturer, released a security bulletin on July 18, 2023, disclosing the existence of three (3) critical vulnerabilities in their Citrix Netscaler Application Delivery Controller (ADC) and Gateway products. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors have successfully compromised the network of a U.S. entity in the critical infrastructure sector after exploiting the most severe of the flaws, a zero-day unauthenticated remote code execution (RCE) vulnerability. The flaw, tracked as CVE-2023-3519, was exploited by threat actors to drop a web shell on a NetScaler ADC appliance in the victim’s non-production environment. The web shell enabled the attackers to conduct reconnaissance on the victim’s active directory (AD) and exfiltrate AD data. According to investigators, the threat actor attempted to pivot and move laterally across the network to a domain controller but failed due to the organization’s network-segmentation controls for the ADC appliance. Investigators stated that the threat actor was able to modify the NetScaler configuration with the web shell in an attempt to deactivate the NetScaler High Availability File Sync (nsfsyncd). At this time, there is not enough evidence for the investigators to attribute the attack to a specific threat actor with high confidence. The tactics, techniques, and procedures (TTPs), however, indicate that it is likely an unidentified cyberespionage group believed to be aligned with the Chinese government. This is based on TTPs used to exploit a similar Citrix ADC and Gateway appliance vulnerability in December 2022 and attributed to APT5, a Chinese state-sponsored threat group known for stealing telecommunications and military application data in the U.S. and Asia. Citrix has stated that unpatched Netscaler appliances must be configured as a gateway or a virtual authentication server in order to be vulnerable to exploitation. The Shadowserver Foundation tweeted that according to scans, at least 15,000 NetScaler servers were exposed to the internet and could be vulnerable to exploitation. The vulnerabilities have been patched, and CTIX analysts recommend that all administrators responsible for maintaining Citrix ADC and Gateway appliances update their infrastructure to the latest patched version. This matter is evolving in real-time, and a follow-on summary may be published in the near future.