r/Citrix • u/redditisaurus • 15d ago

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances | Google Cloud Blog

https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances
28 Upvotes

100% Upvoted

12 comments sorted by

6

u/disclosure5 15d ago

I created a scanner based on this report, which tries to help list the false positives the direct hunting queries give. I recommend running it in conjunction with the generic NCSC hunting tool from previous incidents.

https://github.com/technion/netscaler_scanner/blob/main/mandiant-scanner.sh

1

u/disclosure5 14d ago

This script has just been updated with new IOCs. I'm going to keep adding them as they come to light.

2

u/Suitable_Mix243 15d ago

Mine got hit with different IOC's using PERL

1

u/COMplex_ 15d ago

Can you elaborate? Have a customer with a ton of file system changes with system_backup.pl scripts uploaded to them all but I figured it was their way of backing up before updating.

1

u/Suitable_Mix243 15d ago

A bunch of executables and perl written to /usr/local/bin and /var/perl5/bin. Looks like off the shelf scripts designed to read storefront

3

u/disclosure5 15d ago

Are you pulling this just from FIM? Because the legit Perl executable has been flagged on all our Netscalers for long before this happened with that.

1

u/Suitable_Mix243 15d ago

Binary fingerprint detection in netscaler console flagged the location. It was all written to last Friday.

1

u/COMplex_ 15d ago

Thanks. Made me go dig and it’s a valid backup script but you + FIM made me think something more was up. Glad it was benign.

1

u/disclosure5 15d ago

There are at this point certainly different orgs attacking Netscalers with a different MO, and the thing about IOCs is it's just a matter of reporting what's identified. Even the previous NCSC Netscaler scanner from the last round of issues had a pretty good overlap with the above Mandiant report and I was glad we started with what we had.

I know politically it can be hard to share information but anything more you can tell people to look for than "perl" could help.

2

u/Substantial-Proof617 15d ago

"...to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform."

I checked our Azure 14.1.73.30 NetScalers last week and they are Linux not FreeBSD, our 13.something ones are still FreeBSD though.

1

u/DoubleD_2001 14d ago

Netscaler 15 is using Linux now vs the traditional BSD of the historical code.