Massive Breach – Hundreds of Citrix Servers Backdoored in an RCE Attack

A series of cyberattacks has targeted Citrix Netscaler ADC and Gateway servers, compromising their security and leaving them backdoored. The attacks have exploited a critical remote code execution (RCE) vulnerability, tracked as CVE-2023-3519. Notably, this flaw was previously employed as a zero-day exploit to infiltrate the network of a U.S. critical infrastructure organization.

The Shadowserver Foundation, a non-profit organization dedicated to enhancing internet security, has reported that attackers have deployed web shells on at least 640 Citrix servers during these attacks. The web shells enable the hackers to maintain access to the compromised systems and potentially conduct further malicious activities.

“We can say it’s fairly standard China Chopper but we do not want to disclose more under the circumstances. I can say the amount we detect is much lower than the amount we believe to be out there, unfortunately,” Shadowserver CEO Piotr Kijewski told BleepingComputer.

China Chopper web shell example (BleepingComputer)

While the current detection of compromised appliances stands at 640, the Shadowserver Foundation believes that the actual number of Citrix servers affected by CVE-2023-3519-related web shells could be significantly higher. The vulnerability, which primarily impacts unpatched Netscaler appliances configured as gateways or authentication virtual servers, is serious enough to warrant immediate attention from security teams.