Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 08-Jul-2025 01:53:46 JST Kevin Beaumont

   in reply to

   CVE-2025-5777 (Citrix Netscaler vuln) has been under active exploitation since mid June, with people dumping memory and using this to try to access sessions.

   TTPs to hunt for:

   - In Netscaler logs, large and repeated POST requests to *doAuthentication* - each one yields 126 bytes of RAM

   - In Netscaler logs, requests to doAuthentication.do with "Content-Length: 5"

   - In Netscaler user logs, lines with *LOGOFF* and user = "*#*" (i.e. # symbol in the username). RAM is played into the wrong field.