Loading story…
Researchers reported that APT5 is exploiting a newly disclosed vulnerability in Citrix ADC and Citrix Gateway, adding another high-risk edge-device intrusion case to the threat landscape. The activity highlights continued targeting of internet-facing remote access infrastructure, where successful exploitation can give attackers an initial foothold inside enterprise environments and enable follow-on espionage or broader network compromise.
The reporting appeared alongside separate coverage of a ransomware attack that disrupted Ardent Health Services, underscoring how perimeter compromises and healthcare intrusions remain pressing concerns across sectors. While the incidents involve different threat activity, together they reflect sustained pressure on organizations to rapidly patch exposed appliances, monitor for suspicious access on remote connectivity systems, and strengthen incident response readiness for both state-linked intrusions and financially motivated attacks.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Duo Security published a report that Ardent Health Services had been hit in a ransomware attack. The publication publicly identified the victim and the incident.
Duo Security published a report stating that APT5 was exploiting a newly identified vulnerability affecting Citrix ADC and Gateway products. The report publicly disclosed the exploitation activity and attribution to APT5.
Check Point released a blog post detailing the Petya ransomware and its behavior, providing technical analysis of the threat. This publication marked a public disclosure of technical details about Petya.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-attributed **APT5** actively exploited `CVE-2022-27518`, a critical Citrix ADC and Citrix Gateway flaw that lets an unauthenticated remote attacker execute arbitrary code and bypass authentication controls. The activity prompted a joint U.S. government cybersecurity advisory detailing threat-hunting guidance and indicators associated with exploitation. The vulnerability affects customer-managed Citrix appliances configured as a SAML service provider or SAML identity provider; Citrix ADC and Citrix Gateway 13.1 are not affected. Organizations should urgently apply Citrix’s security updates, disable SAML authentication where operationally feasible until remediation is complete, and hunt for the published indicators of compromise.
Sep 3, 2026
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026
Investigations across multiple incidents have shown attackers gaining and maintaining access through internet-facing infrastructure, including **SonicWall SMA** devices, **Cisco AnyConnect** deployments, and **F5** systems. Truesec reported a persistent web shell on SonicWall SMA appliances, while separate reporting tied exploitation of `CVE-2020-3259` in Cisco AnyConnect to **Akira ransomware** activity. The UK **NCSC** also confirmed a compromise affecting the **F5** network, underscoring that trusted remote-access and application delivery platforms remain high-value targets for intrusion and follow-on operations. The broader pattern mirrors earlier high-impact compromises such as **SolarWinds**, where trusted enterprise technology became a pathway for stealthy access, and more recent financially motivated and state-linked campaigns, including Truesec reporting on a **North Korean threat actor** targeting the Nordic financial sector. Together, the cases show how compromise of edge devices and trusted network infrastructure can enable persistence, credential theft, lateral movement, and downstream attacks against enterprises and critical sectors.
Aug 1, 2026