#citrixbleed2 — Public Fediverse posts

#CISA-Katalog attackierter Schwachstellen wuchs 2025 um 20 Prozent | Security https://www.heise.de/news/CISA-Katalog-attackierter-Schwachstellen-wuchs-2025-um-20-Prozent-11130460.html #Malware #Ransomware #Cl0p #CitrixBleed2

"#CitrixBleed2": Aktuelle Angriffswarnungen | Security https://www.heise.de/news/Citrix-Bleed-2-Aktuelle-Angriffswarnungen-10519742.html

🚨 Over 3,300 Citrix NetScaler devices remain unpatched against the critical #CitrixBleed2 vulnerability (CVE-2025-5777), risking session hijacks & MFA bypass! Attackers can steal session tokens remotely. Patch now to avoid data breaches and network risks! 🔐🛡️ #newz

Details: https://www.bleepingcomputer.com/news/security/over-3-000-netscaler-devices-left-unpatched-against-actively-exploited-citrixbleed-2-flaw/ #Cybersecurity #InfoSec #NetScaler

The Dutch Public Prosecution Service Citrix Netscaler incident is rumbling on. They are working on service recovery.

https://www.databreachtoday.com/dutch-prosecutors-recover-from-suspected-russian-hack-a-29129

#CitrixBleed2

#citrixbleed2 Citrix engineer required!

@GossiTheDog #citrixbleed2 The Dutch Cyber Centre script has been updated with an extra check for xhtml files in /var/netscaler https://github.com/NCSC-NL/citrix-2025/blob/main/TLPCLEAR_check_script_cve-2025-6543-v1.7.sh

Emerging situation to be aware of - some of the #CitrixBleed2 session hijacking victims are also victims of webshell implants via a different vuln, CVE-2025-6543.

Script to check for Netscaler implants: https://github.com/NCSC-NL/citrix-2025/blob/main/TLPCLEAR_check_script_cve-2025-6543-v1.6.sh

#citrixbleed2 Hmm the Dutch Cyber Center script is back: https://github.com/NCSC-NL/citrix-2025 Just looking for php exploits on the Netscalers themselves. @GossiTheDog Any thoughts about this? It’s marked 2025-6543 which makes you wonder a bit which vulnerability was exploited at the OM.

#citrixbleed2 An interesting article (though some mistakes I think) from the Splunk team on cve-2025-5777. I’m not sure whether it’s clumsy wording but they imply that the later cve-2025-6543 was related to cve-2025-5777 (“The vulnerability was disclosed on June 17, 2025, with Citrix expanding the scope and releasing patches by June 23.”) The date is wrong (should be 25th) though so not sure. https://www.splunk.com/en_us/blog/security/citrixbleed-vulnerability-detection-mitigation.html Cool diagram too.

I think CISA, UK NCSC and authorities in Germany likely need to get more proactive on #CitrixBleed2. Left is unpatched CitrixBleed 2, right is that SharePoint vuln. One is a much, much bigger problem leading to nation state actors sat in inside remote access to networks - and it's the Citrix one.

The Dutch Public Prosecution Service #CitrixBleed2 incident rolls on - NRC report on an email from the Director of their IT service, where they say “It is clear that it’s a massive and dramatic incident”.

https://www.nrc.nl/nieuws/2025/07/22/digitale-werkomgeving-om-inderdaad-gehackt-onderzoek-moet-uitwijzen-welke-informatie-is-gestolen-a4901019

Judging from the script, cve-2025-6543 is all about creating backdoors on the Netscalers. #citrixbleed2

Judging from this https://www.ncsc.nl/actueel/nieuws/2025/07/22/casus-citrix-kwetsbaarheid the Dutch Cyber Defence Center is most worried about cve-2025-6543 at the moment. IOC Detection script provided here: https://github.com/NCSC-NL/citrix-2025 #citrixbleed2

I think this thread exposes something about the cybersecurity industry and org posture btw - it almost all runs on Windows and EDR telemetry, hence why there’s little info on this from vendors (Netscaler is closed box appliance - they’re flying blind) and why orgs aren’t seeing anything, they don’t know how without vendors.

I keep contacting orgs and they have no idea they are compromised or how to investigate.

#CitrixBleed2

The NCSC are strongly advising orgs to follow the advice on my blog re #CitrixBleed2, in hindsight I probably shouldn’t have drawn the logo in MSPaint and titled a section “China goes brrrr”.

The Dutch Public Prosecution Service (OM), which took their systems offline due to #CitrixBleed2 on Friday, are saying they will be offline for weeks. https://nos.nl/artikel/2575857 HT @moartn

#CitrixBleed2: Kritische Netscaler-Lücke wird seit fast einem Monat ausgenutzt | Security https://www.heise.de/news/Citrix-Bleed-2-Kritische-Netscaler-Luecke-wird-seit-fast-einem-Monat-ausgenutzt-10492320.html #Patchday #CyberCrime #DataLeak #Datenleck #Datenschutz #privacy #CitrixBleed

The Canadian government cyber centre are this weekend recommending all orgs review historic logs for #CitrixBleed2 compromise, and reset all user sessions https://www.cyber.gc.ca/en/alerts-advisories/vulnerabilities-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2025-5349-cve-2025-5777-cve-2025-6543

Saturday afternoon, Dutch OM still not reconnected to the Internet after Citrix cve-2025-5777 exploit https://www.nrc.nl/nieuws/2025/07/19/digitale-werkomgeving-openbaar-ministerie-nog-steeds-uit-de-lucht-a4900727 #citrixbleed2

I've been working with @shadowserver btw, their scan results for #CitrixBleed2 now show far more vulnerable systems. Their scanning is independent of mine, logic is improving, more orgs will get notifications. I'm going to try getting victims for notification across too.

Updated #CitrixBleed2 scans https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777

I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.

CitrixBleed 2: 100 Organizations Hacked, Thousands of Instances Still Vulnerable https://www.securityweek.com/citrixbleed-2-100-organizations-hacked-thousands-of-instances-still-vulnerable/ #Vulnerabilities #CitrixBleed2 #CitrixBleed2 #exploited #Citrix

CitrixBleed 2: 100 Organizations Hacked, Thousands of Instances Still Vulnerable https://www.securityweek.com/citrixbleed-2-100-organizations-hacked-thousands-of-instances-still-vulnerable/ #Vulnerabilities #CitrixBleed2 #CitrixBleed2 #exploited #Citrix

#citrixbleed2 Latest news from Holland is that the Dutch Public Prosecution office (Openbaar Ministerie) is down (disconnected from Internet) quite likely (from the various reporting) due to an exploited cve-2025-5777. https://www.nrc.nl/nieuws/2025/07/18/openbaar-ministerie-is-offline-vanwege-ernstige-zorgen-over-ict-beveiliging-datalek-niet-uitgesloten-a4900617 The earliest list from @GossiTheDog showed at least quite a few instances patched (*.om.nl) so if this is the problem, they weren’t totally remiss in patching.

Citrix have a blog out about hunting for #CitrixBleed2

https://www.netscaler.com/blog/news/evaluating-netscaler-logs-for-indicators-of-attempted-exploitation-of-cve-2025-5777/

It's what was in my earlier blog - look for invalid characters in the username field and duplicate sessions with different IPs

With the #CitrixBleed2 patch data I publish it's possible to view the history on Github for each new scan and see when hosts change from vuln to patched.

It's proving incredibly effective at getting orgs to patch. I tried private notifications via HackerOne and such for CitixBleed1 in 2023 and it took months to get orgs to patch. Putting the data public brings accountability for orgs who later get breached - so there's a rush to patch.

It's definitely interesting and may need a scale out.

I’m fairly certain the threat actor is Chinese and they reversed the patch to make the exploit.

Citrix continue to be MIA. They still have no detection guidance for customers, and haven’t told customers the extent of the issue.

#CitrixBleed2

GreyNoise blog just out about #CitrixBleed2, they see exploitation from IPs in China from June 23rd targeting specifically Netscaler appliances https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc

CitrixBleed 2 Flaw Poses Unacceptable Risk: CISA https://www.securityweek.com/citrixbleed-2-flaw-poses-unacceptable-risk-cisa/ #Vulnerabilities #CitrixBleed2 #CitrixBleed2 #exploited #CISAKEV #Citrix

CitrixBleed 2 Flaw Poses Unacceptable Risk: CISA https://www.securityweek.com/citrixbleed-2-flaw-poses-unacceptable-risk-cisa/ #Vulnerabilities #CitrixBleed2 #CitrixBleed2 #exploited #CISAKEV #Citrix