A new cyber espionage campaign named Salt Typhoon has been uncovered exploiting a critical Citrix vulnerability to infiltrate targeted networks. This campaign leverages the CVE-2023-4965 vulnerability in Citrix ADC and Citrix Gateway products, allowing attackers to execute arbitrary code remotely. Salt Typhoon is attributed to a sophisticated threat actor group with ties to state-sponsored activities, focusing on intelligence gathering and data exfiltration. The campaign demonstrates advanced tactics including the use of custom malware and stealthy lateral movement within compromised environments. Organizations using Citrix products are urged to apply security patches immediately and enhance monitoring for unusual activities. This incident underscores the persistent threat posed by nation-state actors exploiting zero-day vulnerabilities to conduct espionage and disrupt critical infrastructure. Cybersecurity teams should prioritize vulnerability management and incident response readiness to mitigate such advanced persistent threats. The Salt Typhoon campaign highlights the evolving landscape of cyber threats targeting enterprise networks and the importance of proactive defense measures.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Mon, 20 Oct 2025 12:20:08 +0000