Threat Intel - FortiGate RaaS and Citrix Exploits Emerge
Basically, cybercriminals are using new tricks to exploit software flaws and steal data.
This week's bulletin highlights emerging threats like FortiGate RaaS operations and Citrix exploits. Organizations are at risk as these vulnerabilities are actively targeted. Stay informed and strengthen your defenses against these evolving cyber threats.
The Threat
This week’s ThreatsDay Bulletin reveals a concerning trend in cybersecurity, with various threat actors exploiting vulnerabilities across multiple platforms. The Gentlemen Ransomware-as-a-Service (RaaS) group is particularly notable, leveraging a critical authentication bypass vulnerability (CVE-2024-55591) in FortiOS/FortiProxy. This group has successfully compromised around 14,700 FortiGate devices globally, targeting organizations since its emergence in mid-2025. Additionally, a new campaign is actively exploiting known flaws in Citrix NetScaler, with over 500 exploit attempts recorded recently, signaling a potential escalation in attacks.
Who's Behind It
The Gentlemen RaaS group, consisting of about 20 members, is at the forefront of these attacks. Their operations stemmed from a payment dispute within the cybercrime community, leading to their aggressive tactics. On the other hand, the Citrix vulnerabilities are being exploited by various actors, indicating a broader interest in targeting legacy systems. This trend is alarming as it reflects a shift towards exploiting older vulnerabilities that organizations may not have patched.
Tactics & Techniques
The tactics employed by these threat actors are varied and sophisticated. For instance, the Gentlemen use the bring your own vulnerable driver (BYOVD) technique to evade detection and maintain persistence on compromised devices. In the case of Citrix, the exploitation of CVE-2025-5777 and CVE-2023-4966 shows a clear intent to leverage known weaknesses in widely used systems. Moreover, phishing campaigns impersonating IT staff via platforms like Microsoft Teams are on the rise, exploiting the trust users have in internal communications to gain unauthorized access.
Defensive Measures
Organizations must adopt a proactive approach to mitigate these threats. Regularly updating and patching systems is crucial, especially for those using FortiGate and Citrix products. Implementing multi-factor authentication (MFA) can add an extra layer of security, particularly against phishing attempts. Additionally, raising awareness among employees about the risks of social engineering can help prevent successful attacks. Cybersecurity teams should also monitor for unusual activities and prepare incident response plans to address potential breaches swiftly.