Citrix Netscaler backdoors — May 2025 activity against governments

FanJ · Sep 1, 2025 at 4:37 PM

Citrix Netscaler backdoors — Part One — May 2025 activity against governments
By Kevin Beaumont
31 Aug 2025
https://doublepulsar.com/citrix-net...025-activity-against-governments-f48037199c3f

Long articles with technical details and comments.

This is a follow up post to the prior one, part of a series looking at different Netscaler vulnerabilities that have been exploited in the wild as zero days.
Click to expand...

Previous post some days ago:
Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025
https://doublepulsar.com/citrix-for...sed-as-a-zero-day-since-may-2025-d76574e2dd2c

Quotes from that article:

Back in late June, Citrix posted a patch for CVE-2025–6543, which they described as “Memory overflow vulnerability leading to unintended control flow and Denial of Service”. Denial of service? Piff the magic dragon, who cares.
Click to expand...

It has compromised government and legal services worldwide. Citrix provided customers on request, under weird conditions, a script to check for compromise.. but didn’t explain what was happening, and the script was incomplete.
Click to expand...

NCSC Netherlands have a rather cool report out about CVE-2025–6543, where they’ve essentially done Citrix’s job for them:
Casus: Citrix kwetsbaarheid (Update 13-08-2025)
https://www.ncsc.nl/actueel/nieuws/...e2dd2c---------------------------------------
Click to expand...

Maybe a better link to that NCSC NL article would be:
https://github.com/NCSC-NL/citrix-2025

Backt to that first article I mentioned:

This post will look at a backdoor deployed across western governments and legal institutions earlier this year, over a month before a patch became available. These backdoors were likely installed via Volt Typhoon — there is strong overlap with prior activity, and the attack chain is highly complicated. This is not a ransomware group; it’s espionage.
Click to expand...

I also hope it’s a wider wake up call for the security industry to start looking at Netscaler, as organisations are having woes without being aware for an extended period of time now. Right now it looks like there’s WatchTowr, Horizon3, NCSC in the Netherlands and me, a cartoon porg, basically driving out these incidents. Which is cool and all.. but it feels a bit lonely.
Click to expand...

Read more at those links.

Log in or Sign up

Citrix Netscaler backdoors — May 2025 activity against governments

FanJ Updates Team

Log in or Sign up

Citrix Netscaler backdoors — May 2025 activity against governments

FanJ Updates Team

Useful Searches