Loading story…
At-Bay reported evidence suggesting that the Royal ransomware group exploited CVE-2022-27510, a critical authentication bypass vulnerability affecting Citrix Application Delivery Controller (ADC) and Citrix Gateway, to gain initial access to victims. Citrix disclosed the flaw on November 8, 2022, with no exploitation reported at disclosure. Intelligence obtained by At-Bay in the first week of 2023—including security scans, insurance claims data, and other sources—pointed to suspected exploitation before a public exploit was available. The assessment did not establish exploitation as confirmed.
Royal primarily targeted U.S. companies, and its data leak site suggested a concentration of manufacturing victims, although At-Bay assessed that the group attacked opportunistically across industries. At-Bay urged organizations running affected Citrix products to patch immediately and follow Citrix’s mitigation guidance. Defenders should use the vendor security bulletin to identify affected deployments and required fixes, and investigate potentially exposed systems for signs of unauthorized access rather than treating patching alone as evidence that a deployment is uncompromised.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
During the first week of 2023, At-Bay obtained information suggesting Royal was actively exploiting CVE-2022-27510 for initial access in ransomware attacks. Its assessment drew on security scans, insurance claims, and other intelligence, and indicated suspected exploitation before a public exploit was available.
Citrix announced CVE-2022-27510, a critical authentication bypass vulnerability affecting Citrix Application Delivery Controller and Citrix Gateway. No exploitation in the wild had been reported at disclosure.
The Royal ransomware group emerged in January 2022.
Following Citrix's disclosure, At-Bay began assessing exposure and identifying potentially vulnerable businesses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026
Attackers widely exploited **CVE-2023-4966** (`Citrix Bleed`), a critical flaw in **NetScaler ADC** and **NetScaler Gateway** that can leak sensitive information, including session authentication tokens, and enable authentication bypass or session hijacking on affected Gateway or AAA virtual servers. Citrix issued a critical security update and later published investigation recommendations, while defenders reported attack activity beginning in late October and rising sharply through November. One observed technique targeted `/oauth/idp/.well-known/openid-configuration` with an unusually long `Host` header to steal session cookies, and a large share of detected attack traffic was traced to infrastructure in Germany, followed by Russia, China, Japan, and the United States. The vulnerability was later tied to real-world intrusions, including a **PLAY ransomware** compromise of a professional services firm. After obtaining access through Citrix Bleed, the attackers performed internal reconnaissance to enumerate domain accounts, trusted domains, permission groups, and remote systems before advancing their operation. Security guidance urged organizations running affected NetScaler products, including unsupported `12.1` versions, to apply fixed releases immediately and investigate for signs of token theft or unauthorized session use.
Aug 15, 2026
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026