Cyber Brief: Chinese espionage tools disrupted, Citrix flaw exploited

Today's brief focuses on the operational realities of vulnerability management, supply chain security and the persistence of state-sponsored threat activity. The FBI's disruption of Chinese espionage infrastructure, active exploitation of a recent Citrix NetScaler vulnerability, a cyberattack affecting medical device manufacturer Boston Scientific, and CISA's addition of six vulnerabilities to its Known Exploited Vulnerabilities catalog all highlight the importance of timely patching, visibility across third-party dependencies, and understanding which vulnerabilities are being actively targeted in the wild.

FBI disrupts Chinese espionage infrastructure used to target critical networks

The US Department of Justice announced on Wednesday that it has disrupted two hacking platforms, QScan and QTRouter, operated by Chinese state-sponsored threat actors known as QTFY. According to reporting by TechCrunch, Wired and The Register, the infrastructure was used to target NASA, the US Department of Energy, the US Senate, the Justice Department and other critical networks over a period of more than eight years. The FBI seized domains and command and control servers that were hardcoded into the botnet's infrastructure, rendering the tools inoperable. The activity has been attributed to actors employed by Nanjing Xinjiuwei Network Technology Company, a Chinese firm. The tools allowed attackers to scan for vulnerabilities, establish persistent access and exfiltrate data from highly sensitive networks without detection for extended periods.

While this disruption relates to US government networks, the operational relevance for UK organisations is significant. The tools and techniques used by state-sponsored groups are often repurposed or adapted to target similar infrastructure in other jurisdictions, particularly where organisations rely on the same enterprise technologies, cloud platforms or network appliances. The longevity of the campaign, spanning more than eight years, underscores the importance of continuous monitoring, network segmentation and visibility into anomalous behaviour across critical systems. For UK businesses operating in sectors such as energy, defence, research, legal or government services, this is a reminder that sophisticated threat actors prioritise persistent access over noisy, disruptive attacks.

Why it matters

For UK organisations in critical infrastructure, research, legal or government-facing sectors, this is a prompt to review whether network monitoring, anomaly detection and segmentation controls are sufficient to identify long-term persistence. Consider whether visibility into command and control traffic, unusual scanning activity or lateral movement is adequate, and ensure that incident response plans account for the possibility of undetected access over extended periods.

Source: TechCrunch

Citrix NetScaler vulnerability now under active exploitation

CISA has added a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-8452, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. SecurityWeek reports that CISA is urging US government agencies to patch the flaw immediately. The vulnerability was disclosed recently and allows remote code execution, making it a high-priority target for attackers seeking to compromise internet-facing appliances. Citrix NetScaler products are widely deployed in enterprise environments to manage application delivery, load balancing and secure remote access, meaning successful exploitation can provide attackers with a foothold into corporate networks.

For UK businesses, Citrix NetScaler appliances are commonly used to support remote working, secure access to internal applications and manage traffic across hybrid cloud environments. The fact that this vulnerability is now being actively exploited in the wild means that organisations using affected versions should treat patching as an immediate priority. Internet-facing appliances are frequently targeted because they sit at the perimeter and often have privileged access to internal systems. Delayed patching of perimeter devices increases the window of opportunity for attackers to gain initial access, establish persistence and move laterally across the network.

Why it matters

For UK organisations using Citrix NetScaler ADC or Gateway, this is a prompt to verify whether affected versions are deployed, confirm that patches have been applied, and review whether internet-facing appliances are subject to regular vulnerability scanning and timely patch management. Consider whether monitoring is in place to detect unusual authentication attempts, configuration changes or lateral movement from perimeter devices.

Source: SecurityWeek

Boston Scientific confirms cyberattack causing global operational disruption

Medical device manufacturer Boston Scientific confirmed on Wednesday that it is experiencing a cyberattack causing what the company describes as a "global disruption" to its operations. TechCrunch reports that the company has not disclosed whether medical devices are affected, whether customer or patient data has been exfiltrated, or the nature of the attack. Boston Scientific manufactures a wide range of medical devices including pacemakers, defibrillators, stents and surgical equipment used in hospitals and healthcare settings worldwide. The company's statement acknowledges the operational impact but provides limited detail about the scope, duration or recovery timeline.

For UK organisations, particularly those in healthcare, this incident highlights the operational and patient safety risks associated with cyberattacks on medical device manufacturers and their supply chains. Even if the attack does not directly affect the functionality of medical devices, disruption to manufacturing, distribution, technical support or software updates can have downstream consequences for hospitals and clinics that rely on those products. The lack of transparency about whether devices are affected or whether data has been compromised also underscores the challenge healthcare organisations face when assessing third-party risk and understanding the potential impact of supplier incidents on their own operations.

Why it matters

For UK healthcare organisations, this is a prompt to review whether business continuity plans account for disruption to medical device manufacturers, whether alternative suppliers or support arrangements are available, and whether communication channels with key suppliers are sufficient to obtain timely updates during incidents. Consider whether third-party risk assessments include questions about incident response, transparency and operational resilience.

Source: TechCrunch

CISA adds six actively exploited vulnerabilities to Known Exploited Vulnerabilities catalog

CISA announced on Wednesday that it has added six vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. The Hacker News reports that the list includes CVE-2019-1068 affecting Microsoft SQL Server, CVE-2022-0995 in the Linux kernel, CVE-2015-3246 and CVE-2015-5287 in Red Hat components, CVE-2021-23758 in Ajax.NET Professional, and CVE-2026-8452 affecting Citrix NetScaler. The inclusion of these vulnerabilities signals that attackers are actively targeting them in the wild, and organisations should prioritise patching or mitigation. Some of the vulnerabilities date back several years, highlighting the ongoing risk posed by unpatched legacy systems.

For UK businesses, the KEV catalog serves as a practical prioritisation tool for vulnerability management. While organisations may face thousands of vulnerabilities across their estate, the KEV catalog identifies those that are being actively exploited and therefore represent a higher immediate risk. The presence of older vulnerabilities on the list is a reminder that attackers continue to target known weaknesses in systems that have not been patched or upgraded. For organisations managing complex IT estates, legacy applications or systems with extended support lifecycles, this underscores the importance of maintaining an accurate asset inventory, understanding which systems are exposed, and ensuring that patching processes are effective even for older or less frequently updated components.

Why it matters

For UK organisations, this is a prompt to review whether vulnerability management processes prioritise KEV-listed flaws, whether asset inventories are accurate enough to identify affected systems, and whether patching or compensating controls are in place for legacy systems that cannot be immediately updated. Consider whether the organisation has visibility into which systems are running the affected software and whether those systems are internet-facing or otherwise exposed.

Source: The Hacker News

Today's Key Actions

• Review whether network monitoring, segmentation and anomaly detection controls are sufficient to identify long-term persistence, particularly in critical infrastructure, research or government-facing environments.
• Verify whether Citrix NetScaler ADC or Gateway appliances are deployed, confirm that patches for CVE-2026-8452 have been applied, and ensure that internet-facing appliances are subject to timely vulnerability scanning and patch management.
• Assess whether business continuity plans account for disruption to key suppliers, including medical device manufacturers, and whether third-party risk assessments include questions about incident response, transparency and operational resilience.
• Confirm that vulnerability management processes prioritise CISA KEV-listed flaws, that asset inventories are accurate enough to identify affected systems, and that patching or compensating controls are in place for legacy systems.
• Ensure that ownership of vulnerability management, third-party risk, network monitoring and incident response is clearly assigned and that teams have the resources and authority to act on emerging threats in a timely manner.

Secarma Insight

The stories today reflect a consistent theme: the most significant risks often come from known vulnerabilities, unpatched systems and insufficient visibility into third-party dependencies. Mature security practice is built on the discipline of maintaining accurate asset inventories, prioritising vulnerabilities based on evidence of active exploitation, and ensuring that patching processes are effective across the entire estate, including perimeter devices and legacy systems. Good security also means understanding that supply chain incidents, whether affecting medical device manufacturers or other critical suppliers, can have operational consequences that extend beyond the immediate target. The organisations that manage these risks most effectively are those that have already established clear ownership, regular review cycles and the operational habits needed to respond confidently when new threats emerge.