SYMBOLCOMMON_NAMEaka. SYNONYMS

NOTROBIN  (Back to overview)


Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with its exploits. In effect, the hackers exploit the flaw to get access to the server, kill any existing malware, set up their own backdoor, then block off the vulnerable code from future exploit attempts by mitigation.


Associated Families

There are currently no families associated with this actor.


References
2020-01-17FireEyeWilliam Ballenthin, Josh Madeley
@online{ballenthin:20200117:404:cc95f5f, author = {William Ballenthin and Josh Madeley}, title = {{404 Exploit Not Found: Vigilante Deploying Mitigation for Citrix NetScaler Vulnerability While Maintaining Backdoor}}, date = {2020-01-17}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html}, language = {English}, urldate = {2020-01-17} } 404 Exploit Not Found: Vigilante Deploying Mitigation for Citrix NetScaler Vulnerability While Maintaining Backdoor
NOTROBIN NOTROBIN
2020-01-17The RegisterShaun Nichols
@online{nichols:20200117:friendly:ab2be11, author = {Shaun Nichols}, title = {{'Friendly' hackers are seemingly fixing the Citrix server hole – and leaving a nasty present behind}}, date = {2020-01-17}, organization = {The Register}, url = {https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/}, language = {English}, urldate = {2020-05-18} } 'Friendly' hackers are seemingly fixing the Citrix server hole – and leaving a nasty present behind
NOTROBIN NOTROBIN

Credits: MISP Project