Cybersecurity researchers from Sophos have discovered a new hacking campaign in which the threat actors leveraged a known vulnerability to conduct domain-wide attacks.
According to the researchers’ report, a group called ‘STAC4663’ managed to exploit CVE-2023-3519 to infiltrate vulnerable systems and deploy all sorts of malicious software. The exploit is a remote code execution vulnerability discovered earlier this summer in Citrix NetScaler systems.
Citrix released a patch for the flaw in mid-July this year however Sophos’ report has found not all organizations have applied the patch, leaving their systems vulnerable to malicious third-party penetration.
Links to FIN8
Now, Sophos is warning that simply patching the endpoints will not suffice – organizations will also need to thoroughly inspect their networks and endpoints for signs of potential compromise. To do that, businesses should analyze historical data and look for identified Indicators of Compromise (IoC), which can be found here.
The researchers also said that their findings “align closely” with the report published by Fox-IT earlier this month. In this report, the researchers said they found some 2,000 Citrix NetScaler systems compromised due to CVE-2023-3519.
On the day the report was published (August 14), Fox-IT said 1,828 NetScaler servers were compromised, despite the fact that 1,248 were previously patched against the flaw. “A patched NetScaler can still contain a backdoor,” the researchers explained. “It is recommended to perform an Indicator of Compromise check on your NetScalers, regardless of when the patch was applied.”
The threat actor being attributed with this campaign – STAC4663 – is being linked to FIN8, BleepingComputer reports.
FIN8 is being described as a financially-motivated threat actor, active since at least early 2016. It is also known as Syssphinx, and usually targets businesses in retail, hospitality, healthcare, and entertainment verticals. Its attacks often end with ransomware, as the group was seen deploying different encryptors, including BlackCat.
- Here are the best firewalls to keep your business protected
At TechRookies.com will strive to help turn Tech Rookies into Pros!
Want more articles click Here!
Deals on Homepage!
Subscribe to our newsletters. Here! On the homepage
Tech Rookies Music Here!
Disclaimer: I get commissions for purchases made through links in this post at no charge to you and thanks for supporting Tech Rookies.
Disclosure: Links contain affiliates. When you buy through one of our links we will receive a commission. This is at no cost to you. Thank you for supporting Teachrookies.com
Disclaimer: This article is for information purposes and should not be considered professional investment advice. It contains some forward-looking statements that should not be taken as indicators of future performance. Every investor has a different risk profile and goals. All investments have risks. Always do your own research or hire an expert before investing and trading.