Tag

#lockbit

1 post tagged #lockbit.

Analysis · May 20, 2026 · Colten Anderson

CitrixBleed: the patch closed the leak but left the stolen keys working

CVE-2023-4966 leaked post-MFA session tokens from NetScaler. Organizations that patched and stopped there got breached anyway, because a stolen token still worked after the update. The action that mattered was killing every active session, and a lot of victims skipped it.