NexurAI
The year's most-abused zero-days: MOVEit, Citrix Bleed and the Outlook NTLM leak.
A SQL injection in MOVEit Transfer let the Cl0p group deploy a webshell and mass-exfiltrate data from hundreds of organizations.
Progress MOVEit Transfer (SQL injection) · 2023
The attacker exploits the SQLi to install the 'human2.aspx' webshell, then uses it to enumerate and steal files stored in MOVEit.
Look for human2.aspx (or similarly named) files in the MOVEit webroot, anomalous DB service account activity, and large outbound transfers from the MOVEit host.
Apply Progress's patches, hunt for the known IOCs/webshells, rotate MOVEit service credentials, and review file access logs for exfiltration.
A buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA.
Citrix NetScaler ADC / Gateway · 2023
The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.
Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.
Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.
A zero-click flaw: a crafted calendar/email reminder with a UNC path makes Outlook authenticate to the attacker, leaking Net-NTLMv2 - no user interaction.
Microsoft Outlook (reminder UNC path) · 2023
The attacker sends an appointment with PidLidReminderFileParameter pointing to a UNC path on their server; Outlook connects on reminder, leaking the NTLM hash to relay or crack.
Hunt for outbound SMB (445) to external/unknown hosts from user workstations, and use Microsoft's script to scan mailboxes for malicious reminder properties.
Patch Outlook, block outbound SMB to the internet, add users to Protected Users / enforce SMB signing, and run the mailbox-scanning script.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.