Attackers were inside Citrix NetScaler appliances weeks before anyone knew the flaws existed — planting web shells and tunneling into internal networks. Patching alone no longer settles it. Four minutes. Let's go.
🚨 THE BIG STORY
Citrix NetScaler attacks escalate into mass exploitation
Researchers documented custom web shells, tunneling malware, credential theft and lateral movement across government, financial, education, legal and professional services targets in North America and Europe. Mandiant traces the campaign to early September by suspected state-linked actors. Roughly 42,000 NetScaler hosts sit exposed on the internet.
🧠 Why It Matters
If you run NetScaler, the question has shifted from "did we patch?" to "were we already breached?" Attackers harvested credentials and set up persistence, so a patch doesn't evict them. Citrix's own guidance says to check for compromise after updating — and disabling DTLS only covers one of the two flaws. Ask your IT provider today.
⚡ CYBER IN 60 SECONDS
ShinyHunters beat a security fix by encoding one character. Organizations that wrote a firewall rule for the Oracle PeopleSoft flaw instead of patching are exposed again — the tweaked request sails past the rule and the unpatched server behind it. Oracle warned in June that firewall rules alone were insufficient. FBI applicant portals remain offline. [ShinyHunters Beat the PeopleSoft Fix With One Trick]
AI-driven ransomware is deleting Azure resources. Microsoft says JadePuffer used two compromised machine identities to map a tenant for 15 hours, then destroyed storage accounts, Key Vaults and Function Apps — and went after backup protections first. [AI Ransomware JadePuffer Is Deleting Azure Data]
💼 THE BUSINESS OF SECURITY
Bitget has resumed Bitcoin withdrawals after losing $387.5 million. Attackers got high-level internal credentials and used them to issue fraudulent withdrawal commands across seven blockchains. Suspected North Korean actors, per reporting. Exchange breaches almost always come down to internal access, not broken cryptography. [Bitget Resumes Withdrawals After $387.5M Hack]
🎭 SCAM TO WATCH
Two former US Air Force members were sentenced this week to a combined 189 months for a scam that needed no hacking skill at all. They phished employee email logins, then sent payment instructions from addresses that looked like real business partners — diverting a $1.68 million wire from one victim and $720,000 from another. The FBI logged 24,768 of these complaints and over $3 billion in losses last year. The tell: any email changing bank details for a payment. Legitimate vendors don't mind you calling to confirm. Use the number you already have on file, never one from the email. [Air Force Pair Jailed Over $2.4M Email Scam]
🛡️ TODAY'S SECURE MINDSET
Write down one rule today: no payment details change without a phone call to a known number. Put it in writing so nobody in finance has to judge whether a specific email feels off — the judgment call is what these scams exploit. It takes five minutes and it's the single highest-value control most small businesses are missing. [Air Force Pair Jailed Over $2.4M Email Scam]
See you tomorrow. — SecureMindset