CVE-2023-4966

LockBit, CitrixBleed, and the ICBC Treasury Hack

Post author:Hmmnm
Post published:November 11, 2023
Post category:Ransomware & Malware Security Web & API Security

When LockBit hit ICBC's US broker-dealer on 9 November 2023, Treasury-market connectivity went dark and manual settlement took over for days. The entry path traced to CitrixBleed session tokens stolen before the October patch and never invalidated — exactly what CISA's Emergency Directive 23-08 had warned. LockBit claimed a roughly $9 million ransom demand, never verified. The post walks the token-replay kill chain, the disclosure-era aftermath, and the defensive lesson that remediation includes revocation.

CitrixBleed CVE-2023-4966: Session Tokens Straight From Memory

Post author:Hmmnm
Post published:October 10, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-4966 let attackers read valid session tokens out of NetScaler memory and inherit authenticated sessions wholesale — MFA already passed. CISA's Emergency Directive 23-08 forced hunts and rebuilds as LockBit monetized the access.