Citrix Systems Inc., a renowned provider of remote access software, has recently been hit by a critical vulnerability known as Citrix Bleed. According to cybersecurity researchers and Citrix online posts, the flaw was discovered after being exploited for weeks by government-backed hackers and criminal groups. Although a fix was issued last month, hackers have continued to exploit the bug, specifically targeting customers who have not yet applied the patch.
Eric Goldstein, the Executive Assistant Director for Cybersecurity at the US Cybersecurity and Infrastructure Security Agency (CISA), revealed that multiple malicious actors, including nation-state groups and criminal organizations, are actively taking advantage of the Citrix Bleed vulnerability. Goldstein also emphasized that the flaw could potentially lead to the theft of sensitive information and broader network access.
LockBit, one of the most notorious hacking gangs globally, has been identified as one of the criminal groups exploiting the Citrix Bleed bug. The Financial Services Information Sharing and Analysis Center (FS-ISAC), a global banking security consortium, issued a security bulletin warning financial institutions about the risk associated with this vulnerability. Furthermore, the US Treasury is reportedly investigating whether Citrix vulnerabilities were responsible for the recent ransomware attack on the Industrial & Commercial Bank of China (ICBC).
Citrix first discovered the Citrix Bleed bug on October 10 and promptly released a patch. However, it was later discovered that numerous Citrix customers had been breached before the patch was issued. Cybersecurity researchers found evidence of attacks dating back to late August, raising concerns that these intrusions may have been conducted by a nation-state for espionage purposes.
Despite the urgency of patching and other recommended actions, thousands of companies failed to update their Citrix software promptly. Palo Alto Network's Unit 42 teams found that at least 6,000 vulnerable IP addresses were identified, with the highest concentration of devices located in the US, Germany, China, and the UK.
LockBit, known for both its gang name and producing ransomware, has been actively exploiting the Citrix flaw. Security researcher Kevin Beaumont revealed that LockBit's exploitation extends to multiple victims, including the law firm Allen & Overy, aviation giant Boeing Co., and port operator DP World Plc. In response to these incidents, Citrix updated its guidance, recommending not only patching but also terminating all active and persistent sessions.
The cybersecurity community warns that the Citrix Bleed flaw is considered "incredibly easy to exploit," which further highlights the growing threats in the cyber landscape. Allen & Overy confirmed a breach of a few storage servers but stated that core systems remained unaffected. Boeing and DP World have not confirmed if the Citrix vulnerability was exploited in their cases.
As the Citrix Bleed vulnerability continues to be exploited, it raises concerns about the overall security of remote access software and the rising sophistication of hackers seeking to exploit these flaws. Urgent action is required to patch affected systems and implement necessary security measures to mitigate the risks.