November 24, 2023 By Pieter Arntz
In a joint cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), along with other international agencies, warn that ransomware gangs are actively exploiting the Citrix Bleed vulnerability.
Affiliates of at least two ransomware groups, LockBit and Medusa, have been observed exploiting Citrix Bleed as part of attacks against organizations. Both are globally significant, and were ranked as the first and sixth most active groups in our November ransomware review.
Known ransomware attacks by ransomware group, October 2023
Mandiant states it is currently tracking four distinct uncategorized groups involved in exploiting this vulnerability.