MalwareExploits 1 CVE

NPS

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2023-3519Unauthenticated RCE in Citrix NetScaler ADC and GatewayExploited in the wild

CISA is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell...

via cisacisa.gov

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence2

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Persistence

2 techniques

T1505.003Web ShellEvidence1

A 2023 CISA investigation into a campaign against Citrix NetScaler devices noted a 'NPS tunneller' deployed after attackers had deployed a webshell onto a compromised appliance.

T1543.003Windows ServiceEvidence1

The NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

The NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

[The altered DLL] loads a beacon in base64 format from a file named config.ini ... [NPS] strings [were] encrypt[ed] during compilation.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

port-forwarding/proxy tunneling tool used to relay traffic through compromised hosts

Command and Control

5 techniques

T1090ProxyEvidence2

The attacker established a proxy connection to 206.237.0[.]49 ... [and] Rakshasa ... creates a proxy tunnel to the threat actor infrastructure.

T1090.001Internal ProxyEvidence3

Once the NPC (NPS client) is running on a foothold and has dialed out to the operator’s NPS server, that server exposes a SOCKS5 listener whose traffic tunnels back through the connection and exits inside the victim network.

T1090.002External ProxyEvidence1

Several entries mention use of proxy and tunneling tools including PLINK, Venom proxy, GOST reverse proxy, Ligolo, Cloudflared, rsocx reverse proxy, Iox proxy tool, NPS tunneling tool, and AirVPN.

T1105Ingress Tool TransferEvidence1

As part of their initial exploit chain [T1190], the threat actors uploaded a TGZ file [T1105] containing a generic webshell [T1505.003], discovery script [TA0007], and setuid binary [T1548.001] on the ADC appliance.

T1572Protocol TunnelingEvidence2

NPS gives an operator a low-footprint reverse tunnel that can be deployed alongside existing control channels to support further network pivoting and access to internal resources.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app29 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

talosintelligence otherNews

Feb 8, 2024

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

Named as an example of a reverse proxy tool used by threat actors generally, not specifically tied to the observed intrusion.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

NPS

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2023-3519Unauthenticated RCE in Citrix NetScaler ADC and GatewayExploited in the wild

via cisacisa.gov

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence2

Persistence

2 techniques

T1505.003Web ShellEvidence1

A 2023 CISA investigation into a campaign against Citrix NetScaler devices noted a 'NPS tunneller' deployed after attackers had deployed a webshell onto a compromised appliance.

T1543.003Windows ServiceEvidence1

The NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

The NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

[The altered DLL] loads a beacon in base64 format from a file named config.ini ... [NPS] strings [were] encrypt[ed] during compilation.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

port-forwarding/proxy tunneling tool used to relay traffic through compromised hosts

Command and Control

5 techniques

T1090ProxyEvidence2

The attacker established a proxy connection to 206.237.0[.]49 ... [and] Rakshasa ... creates a proxy tunnel to the threat actor infrastructure.

T1090.001Internal ProxyEvidence3

T1090.002External ProxyEvidence1

Several entries mention use of proxy and tunneling tools including PLINK, Venom proxy, GOST reverse proxy, Ligolo, Cloudflared, rsocx reverse proxy, Iox proxy tool, NPS tunneling tool, and AirVPN.

T1105Ingress Tool TransferEvidence1

T1572Protocol TunnelingEvidence2

NPS gives an operator a low-footprint reverse tunnel that can be deployed alongside existing control channels to support further network pivoting and access to internal resources.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app29 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

talosintelligence otherNews

Feb 8, 2024

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

Named as an example of a reverse proxy tool used by threat actors generally, not specifically tied to the observed intrusion.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.