Citrix Flaw Opens Networks To Ransomware Risk

Attackers are attempting to use a recently patched critical Citrix bug to infect organisations with ransomware, researchers have found.

Computer security firm FireEye said the ransomware efforts are a new addition to hackers’ efforts to exploit the flaw.

Earlier attacks had attempted to place cryptocurency miners or a previously unknown malware variant called NOTROBIN.

Citrix released patches for the directory traversal flaw, CVE-2019-19781, which affects several versions of Citrix Application Delivery Controller (ADC) and Citrix Gateway, last week.

Compromise scanner

The company also worked with FireEye to release an indicator of compromise (IoC) scanner to help customers determine whether their systems have been breached using the flaw.

The bug can be exploited to gain unauthorised remote access to a network and execute malicious code, researchers said, giving it a 9.8 out of 10 threat level.

FireEye said attackers had been “swift” to attempt to exploit the Citrix flaw and said “multiple actors” were carrying out attacks.

In a Friday update, the company said it had found one attacker attempting to install the Ragnarok ransomware via vulnerable Citrix Gateway deployments.

The attacker is “using multiple exploits to take advantage of vulnerable internal systems and move laterally inside the organisation”, FireEye said in an advisory.

“If suspect your Citrix appliances may have been compromised, we recommend utilising the tool FireEye released in partnership with Citrix.”

Traffic jam

In the Netherlands, the Citrix flaw has been held responsible for worse-than-usual road traffic in the country after the Dutch National Computer Security Centre (NCSC) recently recommended taking vulnerable systems offline.

As a result, most Dutch government ministries took remote-access servers offline, resulting in traffic jams last week as more government workers made their way into their offices.

The Citrix installations involved had been used by government employees to work remotely, according to local reports.