Maverc
All articlesVulnerabilities

Recent Exploits Target Citrix and VMware Vulnerabilities

January 29, 20245 min readMaverc Threat Research · Threat Advisory
VulnerabilitiesRansomwareThreat AdvisoryCloud SecurityNetwork SecurityVirtualization
Recent Exploits Target Citrix and VMware Vulnerabilities

Citrix NetScaler and VMware vCenter flaws continue to drive initial access for ransomware crews. Here's the current exposure and what to do.

Two long-running CVE families continue to drive ransomware initial access in 2024: Citrix NetScaler ADC/Gateway (CitrixBleed and follow-on flaws) and VMware vCenter (multiple authentication and deserialization bugs). Both are heavily targeted because the appliances sit at the network edge or at the heart of the virtualization stack.

What's Being Exploited

  • Citrix NetScaler — CitrixBleed (CVE-2023-4966) session token leakage; multiple subsequent advisories. Active session hijack against unpatched gateways.
  • VMware vCenter — CVE-2023-34048 (DCERPC out-of-bounds write, pre-auth RCE) and follow-on bugs.

Recommended Response

  • Patch every affected appliance to the latest fixed version.
  • For NetScaler: terminate all active sessions and force reauthentication after patching — patching alone does not invalidate stolen tokens.
  • Restrict management interfaces to trusted networks.
  • Hunt for indicators of compromise published in the vendor advisories.
  • Reset credentials for accounts that authenticated to the appliance during the exposure window.

Edge appliances are now the front line. Treat every advisory on them as a potential incident, not a maintenance ticket.

Keep reading

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack
Identity Security

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack

Push-based MFA was a decade-old patch on a broken model. Here's how AiTM toolkits like EvilProxy and Tycoon 2FA defeat it — and the phishing-resistant controls that actually stop them.

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had
Compliance

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had

If you handle CUI, the C3PAO assessment is coming. Here's the 10-step readiness path Maverc walks every defense industrial base client through before the auditor shows up.

What a Modern OT Ransomware Attack Looks Like — And How to Survive One
OT / ICS Security

What a Modern OT Ransomware Attack Looks Like — And How to Survive One

From IT pivot to PLC shutdown, today's OT ransomware crews follow a repeatable playbook. Here is what we see in the field and the segmentation controls that contain the blast.