LockBit 3.0 exploits Citrix Bleed to bypass MFA and hijack sessions
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
LockBit 3.0 affiliates exploit CVE-2023-4966 in Citrix NetScaler to bypass authentication and gain admin access across critical infrastructure.
CVE-2023-4966, known as Citrix Bleed, is a critical vulnerability in Citrix NetScaler ADC and Gateway appliances that allows attackers to bypass multifactor authentication and hijack legitimate user sessions. LockBit 3.0 ransomware affiliates have actively exploited this vulnerability since at least August 2023 to obtain initial access to target networks. The attack chain begins with a crafted HTTP Host header that causes the vulnerable NetScaler appliance to return sensitive memory information containing valid AAA session cookies, enabling attackers to establish authenticated sessions without credentials. Once inside, affiliates acquire elevated permissions to harvest credentials, move laterally, and access data before deploying ransomware.
The vulnerability affects NetScaler ADC and Gateway versions 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19, 12.1 (end-of-life), and corresponding FIPS variants. Exploitation is trivial due to publicly available exploits. LockBit 3.0 has historically targeted organizations across multiple critical infrastructure sectors including education, energy, financial services, healthcare, manufacturing, and transportation. Post-exploitation activity includes deployment of malicious DLLs (adobelib.dll), use of remote access tools like AnyDesk and Splashtop, and execution of PowerShell and batch scripts for credential harvesting, LSASS memory dumping, and lateral movement via WinRM.
CISA, FBI, MS-ISAC, and Australian Cyber Security Centre urge immediate patching of unpatched NetScaler appliances and isolation of vulnerable systems pending updates. Organizations should hunt for anomalous session activity, unusual login patterns from disparate geographies, and execution of suspicious tools or scripts. Defenders should monitor for requests to adobe-us-updatefiles.digital and related infrastructure, search for LockBit-specific file markers, and review NetScaler logs for evidence of session hijacking.
Mentioned in this report
Detection guidance
LSASS Memory Dump via Comsvcs MiniDump or ProcDump
Detects LSASS memory dumping through rundll32 comsvcs.dll MiniDump or procdump targeting lsass, as used by ransomware affiliates for credential harvesting after initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LSASS Memory Dump via Comsvcs MiniDump or ProcDump
description: Detects LSASS memory dumping using comsvcs.dll MiniDump (via rundll32)
or procdump against lsass. Matches the credential harvesting and LSASS dumping stage
seen after Citrix Bleed session hijacking by LockBit 3.0 affiliates.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection_comsvcs:
CommandLine|contains|all:
- comsvcs
- MiniDump
selection_procdump:
Image|endswith:
- \procdump.exe
- \procdump64.exe
CommandLine|contains: lsass
condition: 1 of selection_*
falsepositives:
- Authorised red team or incident response staff dumping LSASS with procdump
- Debugging of authentication issues by administrators using procdump
level: high
id: 0e4af395-772c-5e2c-b1aa-69d9b7ad58a7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
Command Shell or PowerShell Spawned by WinRM Host Process
Detects wsmprovhost.exe (WinRM remote shell host) spawning cmd.exe or PowerShell, indicating remote command execution over WinRM for lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Shell or PowerShell Spawned by WinRM Host Process
description: Detects wsmprovhost.exe spawning cmd.exe or powershell.exe. This indicates
remote command execution over WinRM, which LockBit 3.0 affiliates used for lateral
movement after Citrix Bleed initial access.
tags:
- attack.lateral-movement
- attack.t1021.006
- attack.execution
- attack.t1059.001
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \wsmprovhost.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection
falsepositives:
- Administrators running PowerShell remoting or Invoke-Command for routine management
- Configuration management or monitoring tools that use WinRM
level: medium
id: 2e23e316-84fb-5946-8c11-59998cd66920
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
AnyDesk Silent Install with Persistence Options
Detects AnyDesk launched with silent install and start-with-Windows flags, a pattern used to deploy remote access tools for persistence during ransomware intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AnyDesk Silent Install with Persistence Options
description: Detects AnyDesk executed with --install and --silent or --start-with-win
arguments. The report describes ransomware affiliates deploying remote access tools
such as AnyDesk after gaining access through Citrix Bleed.
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \AnyDesk.exe
- CommandLine|contains: AnyDesk
selection_args:
CommandLine|contains:
- --install
- --start-with-win
- --silent
condition: selection_img and selection_args
falsepositives:
- IT helpdesk deploying AnyDesk through software distribution tooling
level: medium
id: cd7713d0-1df8-5a57-82fe-7bf90031b8f7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
4 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs