Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Attackers exploited Citrix NetScaler appliances over UDP/443 and DTLS to gain initial root-level access. (‘transmitting specially malformed or fragmented record headers induces heap memory boundary corruption… to execute arbitrary shellcode with root-level operating system privileges’)
• [T1133 ] External Remote Services – The appliances exposed remote access services and VPN gateway functionality that attackers targeted as the entry point. (‘Citrix NetScaler ADC and NetScaler Gateway appliances’)
• [T1505.003 ] Web Shell – Attackers deployed custom PHP web shells such as WHIPSHOT and installer shells to execute commands and maintain access. (‘the deployment of additional custom malware including WHIPSHOT (a PHP web shell)’)
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The web shells executed shell commands such as chmod, restart commands, and reboot operations. (‘chmod u+s /bin/sh’, ‘initiated an appliance reboot’, ‘restart the Apache daemon’)
• [T1059.006 ] Command and Scripting Interpreter: Python – SLAPSHOT was a Python tunneler launched with python -c to run encoded payloads. (‘nohup -c … base64.b64decode’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – WHIPSHOT used HTTP headers and HTTP responses to carry commands and tunneled data. (‘extracts Base64-encoded commands from the HTTP_NSC_LDAP header’)
• [T1090 ] Proxy – SLAPSHOT proxied traffic into internal hosts and WHIPSHOT relayed client requests to the local loopback proxy. (‘capable of proxying traffic into internal networks’, ‘establishes a socket connection to 127.0.0.1’)
• [T1027 ] Obfuscated Files or Information – Commands and payloads were Base64-encoded to hide content in headers and scripts. (‘Base64-encoded command-and-control payloads’, ‘Base64-encoded commands’)
• [T1105 ] Ingress Tool Transfer – The actor staged and deployed custom malware and web shells onto compromised appliances. (‘staged in files with .deb and .sig extensions’)
• [T1053.003 ] Scheduled Task/Job: Cron – Attackers scrubbed references from /etc/crontab to hide persistence and staging paths. (‘scrubs references to /vpn/scripts/linux from /etc/crontab’)
• [T1543.002 ] Create or Modify System Process: Systemd/Service? – Not directly indicated; omitted.
• [T1548.001 ] Abuse Elevation Control Mechanism: Setuid and Setgid – Attackers set the setuid bit on /bin/sh to preserve root execution for later web requests. (‘chmod u+s /bin/sh’)
• [T1070.004 ] File Deletion – The actor removed or hid traces by scrubbing logs and installation paths. (‘systematically scrub its installation path from system `/etc/crontab`’)
• [T1211 ] Exploitation for Defense Evasion – Spoofed 404 responses and path-masking helped conceal web shell activity. (‘returns a spoofed HTTP 404 Not Found response code’)