eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
CVE-2025-7775 NetScaler ADC and Gateway Zero-Day
Bottom Line: Citrix released security patches for three vulnerabilities in different Citrix NetScaler ADC and Gateway versions. Among the three, Citrix confirmed active exploitation of CVE-2025-7775, which enables unauthenticated Remote Code Execution and Denial of Service.
A critical security advisory has been issued for NetScaler ADC and Gateway systems, highlighting three significant vulnerabilities (CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424) that could allow Remote Code Execution (RCE), Denial-of-Service (DoS) attacks, and unauthorized access to management interfaces. Citrix confirmed that active exploitation has been observed in the wild for CVE-2025-7775 (CVSS: 9.2). CVE-2025-7775 is a memory overflow flaw affecting Citrix NetScaler ADC and Gateway appliances.
The scale of exposure is significant with the Shadowserver Foundation identifying over 28,200 vulnerable Citrix NetScaler instances accessible globally. Of these, the United States accounted for approximately 10,100 vulnerable systems, Germany for 4,300, the United Kingdom for 1,400, the Netherlands for 1,300, Switzerland for 1,300, Australia for 880, Canada for 820, and France for 600.
While Citrix confirmed that exploitation attempts of CVE-2025-7775 have been observed in the wild, no detailed technical information or publicly available Proof-of-Concept (PoC) exploit code has been released at the time of writing. Security researcher Kevin Beaumont has proposed that it may have been exploited to deploy web shells. For further details regarding the vulnerability, refer to the security advisory published by eSentire’s Threat Intelligence team on August 26th, 2025.
eSentire Threat Intelligence Analysis:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-7775 to its Known Exploited Vulnerabilities (KEV) catalog. In recognition of the critical risk posed, CISA has imposed an accelerated remediation deadline, requiring federal agencies to patch affected appliances within two days, by August 28, 2025, rather than the usual three-week timeframe.
The exploitation of CVE-2025-7775 underscores the continued targeting of Citrix NetScaler appliances by adversaries. These appliances are frequently deployed in enterprise and government environments, making them a high-value target. With a CVSS score of 9.2, the vulnerability is critical, and its confirmed exploitation makes it an immediate risk for organizations that expose NetScaler systems to the internet. Because successful exploitation requires Gateway, AAA, HDX, or IPv6 load-balancing configurations, adversaries are likely to prioritize these setups, which are commonly found in remote-access deployments.
Citrix has released patches for supported product versions. For version 14.1, organizations must upgrade to 14.1-47.48 or later. For version 13.1, the fixed release is 13.1-59.22 or later. For FIPS and NDcPP editions, version 13.1 requires upgrading to 13.1-37.241 or later, while version 12.1 requires upgrading to 12.1-55.330 or later. However, Citrix versions 12.1 and 13.0 have already reached End-of-Life (EoL) status and will not receive security updates. Organizations using these versions are strongly advised to migrate to supported releases immediately.
The short remediation deadline mandated by CISA demonstrates the severity of this vulnerability. This accelerated timeline suggests that the vulnerability is being used in active campaigns, potentially including government or critical infrastructure targets. Based on historical precedent, including previous Citrix exploited vulnerability such as CVE-2025-6543 and CVE-2025-5777 it is highly likely that this vulnerability will soon be integrated into ransomware campaigns and broader intrusion activity if it has not already been.
eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-7775. Additionally, eSentire MDR for Log has implemented detections to identify suspicious remote access and command execution activities on NetScaler appliances. The eSentire Threat Response Unit (TRU) is actively monitoring this issue to explore further detection opportunities.
Salt Typhoon: Countering Chinese State-Sponsored Actors
Bottom Line: A joint report from intelligence and law enforcement agencies across several countries has linked cyber espionage activity to Salt Typhoon, a threat actor backed by the Chinese state. The operation included both targeted and opportunistic attacks on network infrastructure of various industries across the globe.
On August 27th, 2025, a joint Cybersecurity Advisory (CSA) was published by intelligence and law enforcement agencies from multiple countries, providing insights into a global cyber espionage campaign conducted by the Chinese state-sponsored APT group Salt Typhoon (also known as RedMike, UNC5807, GhostEmperor). The joint advisory was written in coordination by organizations from Australia, Canada, Japan, New Zealand, the United States, and several European countries, with the aim to provide Tactics, Techniques, and Procedures (TTPs) used by Salt Typhoon that have been observed through various government and industry investigations.
Salt Typhoon is believed to have begun operations in 2019, and as per the advisory, has been performing global operations since at least 2021. Targeted industries include, but are not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks. As per the joint advisory, operations of the group have been linked to multiple Chinese companies which provide “cyber-related products and services to China’s intelligence services”, which have been used to enable “Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world”.
Salt Typhoon is known to target vulnerabilities within edge devices as means for initial access. Examples of vulnerabilities that the group have targeted within previous attacks include CVE-2024-21887 (Ivanti Connect Secure), CVE-2024-3400 (Palo Alto Networks PAN-OS), CVE-2023-20273, CVE-2023-20198, and CVE-2018-0171 (Cisco Internetworking Operating System (IOS) XE). The provided list is not exhaustive, and the authoring agencies suspect that the group will continue to evolve tactics over time, adapting their techniques as new vulnerabilities are discovered.
Once initial access to an organization is achieved, Salt Typhoon actors will attempt to establish persistent access to the network. This has been observed being achieved through the modification of Access Control Lists (ACLs) to explicitly allow traffic with Command-and-Control (C2) IP addresses, or by opening standard and non-standard ports to expose different services, such as Secure Shell (SSH), Remote Desktop Protocol (RDP), or File Transfer Protocol (FTP). The threat actors will use “protocols and infrastructure involved in authentication” to facilitate lateral movement to other devices, with an example being the Terminal Access Controller Access Control System Plus (TACACS+) protocol. The group is known to passively collect packet capture (PCAP) data from networks, specifically network traffic from compromised devices and routers that may contain credentials. For data exfiltration, Salt Typhoon utilizes IPsec or Generic Routing Encapsulation (GRE) tunnels to create covert channels and blend in with normal network traffic.
eSentire Threat Intelligence Analysis:
In 2024, Salt Typhoon was linked to a cyber espionage campaign targeting telecommunications companies within the United States, which was referred to as “one of the most damaging series of cyberattacks ever undertaken against the United States”. The attack involved breaches in at least nine major telecommunications organizations in the U.S., resulting in the compromise of metadata of phone calls, text messages, and communications data for both American citizens and political leaders. Salt Typhoon allegedly was also able to compromise the network of a U.S. state's Army National Guard, remaining undetected from March - December 2024. Within their annual threat assessment report from 2024, the U.S. indicated that China “remains the most active and persistent cyber threat to U.S. Government, private-sector, and critical infrastructure networks”, with cyber espionage campaigns being used to obtain sensitive information for financial, strategic, or political advantage. Despite recent callouts against cyber espionage activity linked to China from various countries, Chinese officials have denied links to the Salt Typhoon operation.
In the joint advisory, the authors stated that Salt Typhoon has had “considerable success” exploiting known vulnerabilities, and that “exploitation of zero-day vulnerabilities has not been observed to date”. This claim is notable, as Chinese state-sponsored threat actors have been known to exploit zero-day vulnerabilities, with recent examples being the groups Linen Typhoon and Volt Typhoon exploiting the zero-day vulnerability CVE-2025-53770 within espionage related attacks. In response to these attacks, Microsoft allegedly made changes to their Microsoft Active Protections Program (MAPP), limiting access to organizations in countries required to report vulnerabilities to the government, which includes China, in an attempt to curb possible leaks. The advisory also highlights opportunistic attacks against organizations that do not “align with the actors’ core targets of interest”, as these attacks may allow compromised devices and trusted connections to be leveraged to pivot into other networks. This tactic is notable as it indicates that Salt Typhoon may exploit certain vulnerabilities on a larger scale, with the possible notion that the threat actors can lay dormant within a network and use the access within attacks if needed in the future.
Due to targeted and opportunistic attacks, all organizations should take preventative actions in order to mitigate risk. Organizations should develop robust patch management policies to ensure that vulnerabilities within edge devices are identified and patched within a timely manner. Organizations should also review the advisory, which provides general mitigation and recommendation steps, which should be implemented as needed. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to the CVEs outlined within the report, and eSentire MDR for Network has detections in place to identify exploitation attempts for the vulnerabilities as well. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
Bottom Line: A large-scale data theft campaign, conducted by UNC6395, targeted Salesforce instances through compromised Salesloft Drift OAuth tokens, stealing sensitive data with a focus on credentials. All organizations using Drift-Salesforce integration should assume compromise and take immediate security measures.
On August 20th, 2025, Salesloft published an advisory addressing a security issue related to their Drift application, impacting Salesforce-Drift integration. On August 26th, 2025, Google Threat Intelligence Group (GTIG) reported on the activity, quoting it as a data theft campaign that began on August 8th, 2025, and continued at least until August 18th, 2025. The activity was attributed to threat actor UNC6395, who exfiltrated Salesforce data, leveraging previously compromised OAuth tokens associated with the Salesloft Drift third-party application.
Based on GTIG’s investigation, the primary goal of this campaign was to harvest credentials, specifically Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens. UNC6395 compromised OAuth tokens for the "Drift Email" integration. The threat actor was observed executing queries to access data related to Salesforce objects, including Cases, Accounts, Users, and Opportunities, and subsequently deleting the associated query jobs. GTIG advises organizations using Salesloft Drift to treat all authentication tokens stored in or linked to the Drift platform as potentially compromised.
As per Salesloft’s update, this campaign does not affect organizations that do not use Drift-Salesforce integration. Salesloft, in coordination with Salesforce, revoked all active access and refresh tokens for the Drift application. It is confirmed that the issue is not due to any vulnerability within the Salesforce platform. As the investigation is ongoing, Salesforce has removed the Drift application from the Salesforce AppExchange and disabled all Salesloft integrations with Salesforce until further notice. As a precautionary measure, Drift integrations with Slack and Pardot have been suspended pending the outcome of the ongoing investigation. While the situation is still developing, Salesloft has reported that there is currently no evidence of ongoing malicious activity.
eSentire Threat Intelligence Analysis:
Salesforce is a cloud-based Customer Relationship Management (CRM) platform that helps organizations manage vast amounts of data by centralizing customer information, sales activities, service requests, marketing campaigns, and more. It stores detailed customer profiles, sales pipelines, support cases, and marketing engagement data, while also supporting internal workflows and compliance records. Salesforce’s ability to integrate with tools like Google Workspace, Slack, AWS, and Snowflake enhances collaboration and data sharing across an organization, making it a critical hub for driving business operations. Given the vital role Salesforce data plays within an organization’s network, it is frequently targeted by threat actors, as this centralized repository provides an attractive entry point to access sensitive information and launch further attacks.
While little is known about the threat actor UNC6395, their intent to steal credentials raises significant concerns that affected organizations could face follow-up attacks. Threat actors frequently sell stolen credentials on underground marketplaces, where they can be purchased by other malicious actors for use in a variety of cyberattacks, such as account takeovers, ransomware, and data breaches. Such campaigns can result in data extortion, where threat actors demand ransom in exchange for not leaking stolen data. In June 2025, Google was targeted in a vishing attack carried out by ShinyHunters (UNC6040), which resulted in unauthorized access to its Salesforce CRM environments. In this incident, the threat group told BleepingComputer that their goal was to publicly release the data, not to seek ransom.
This campaign highlights the potential risks associated with third-party integrations. GTIG recommends that organizations review all third-party integrations connected to their Drift instance to identify any potentially malicious or unauthorized access. Following the discovery of the data theft campaign, Salesloft revoked all active access and refresh tokens associated with the Drift application. As a result, administrators will be required to re-authenticate their Salesforce connection once the integration is re-enabled after the investigation concludes. Organizations are advised to revoke and rotate credentials, API keys, and authentication tokens associated with Drift integration and harden access controls by restricting permissions for connected applications within Salesforce, ensuring they have only the minimum necessary access. For additional mitigations refer to the list of recommendations provided by GTIG.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
