Tech Brief - Citrix Bleed Abused by Ransomware Crews

Executive Summary: TrustedSec warns that the Citrix NetScaler vulnerability CVE-2023-4966 ("Citrix Bleed") is being actively abused by ransomware crews to hijack sessions and move laterally — an observed incident allowed access impacting 60 credit unions. The brief highlights limited NetScaler logging and detection gaps and recommends improving log collection, developing detections for attack paths, and rehearsing incident response.