KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2023-4966
Citrix · NetScaler ADC and Gateway
Sensitive information disclosure vulnerability ('Citrix Bleed') allowing unauthenticated session token hijacking exploited by LockBit 3.0 affiliates.
Correlated Federal Court Cases & Exploitation Context (2)
Docket 2:24-cr-00330 · U.S. District Court for the District of New Jersey
U.S. v. Khoroshev et al. (LockBit Ransomware Operation) Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Exploitation Ground Zero: Exploitation of perimeter gateway vulnerabilities (such as Citrix Bleed CVE-2023-4966) and acquisition of compromised corporate VPN logins from Initial Access Brokers (IABs).
Operational Impact: Over 2,500 organizations breached worldwide across 120 countries, including Boeing, the UK Royal Mail, hospitals, and emergency dispatch centers. Extorted more than $500 million in ransom payments before an international coalition of 10 law enforcement agencies seized the infrastructure under Operation Cronos.
Sector: Healthcare, Education, Manufacturing, Government, Financial Services · Loss: $500.0 million
Inspect Full Case Dossier →
Docket SEC Form 8-K Disclosure · U.S. District Court for the Eastern District of Virginia
Boeing Commercial Airplanes Parts Supply Extortion LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.
Exploitation Ground Zero: Exploitation of the CitrixBleed vulnerability (CVE-2023-4966) on an internet-facing Citrix NetScaler ADC gateway, enabling unauthenticated remote attackers to dump memory and hijack valid enterprise user sessions.
Operational Impact: LockBit ransomware group exfiltrated approximately 43 gigabytes of internal parts distribution, aerospace supplier, and technical documents, publishing the entire archive on their Tor leak site after Boeing refused to pay the extortion demand.
Sector: Aerospace, Defense & Manufacturing · Loss: $60.0 million
Inspect Full Case Dossier →
Associated Government Advisories
- AA23-325A CISA Alert →