Unite With Your Peers to Stop Freight Fraud

Table of Contents

Cyberthreat Analysis

• Citrix NetScaler Products Confirmed to be Under Exploitation
• Aqua's Trivy Vulnerability Scanner Hit by Supply Chain Attack
• No Safe Distance: The Business Impact of Recent Global Developments

Industry News

#NMFTACyber On Demand

Citrix NetScaler Products Confirmed to be Under Exploitation

Threat actors are actively exploiting a critical vulnerability in Citrix NetScaler ADC and NetScaler Gateway, and at least one research firm warns the threat activity could involve multiple flaws, Cybersecurity Dive has learned. 

Citrix disclosed an insufficient input validation vulnerability, tracked as CVE-2026-3055, which leads to memory overread. The vulnerability has a severity score of 9.3. 

Government authorities and security researchers have warned the vulnerability could lead to a new wave of exploitation that rivals the 2023 CitrixBleed campaign, when a series of major companies were hacked by LockBit 3.0 and other groups.

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies were required to take remediation measures against the vulnerability by Thursday, April 2.

Researchers from watchTowr and Defused said hackers are exploiting the vulnerability, and watchTowr warned in a post that multiple flaws could be involved.  

Researchers told Cybersecurity Dive that exploitation has been happening. Netscaler ADC and NetScaler Gateway users should check for prior infections. 

“Given that there is now evidence of in-the-wild exploitation since at least March 27, organizations that leverage a vulnerable configuration must check for signs of prior exploitation and/or signs of prior compromise, and if found, trigger their incident response process,” Benjamin Harris, founder and CEO of watchTowr, told Cybersecurity Dive. 

Appliances configured as a Security Assertion Markup Language identity provider [SAML IdP] are the ones vulnerable.

Aqua's Trivy Vulnerability Scanner Hit by Supply Chain Attack

On March 1, Trivy’s maintainers announced that the scanner’s GitHub repository had been compromised in an attack involving a GitHub Actions workflow issue. Some releases were deleted, and malicious versions of the application’s VS Code extensions were published to the Open VSIX marketplace.

The attack was part of a larger, automated attack campaign that hit multiple open source repositories via GitHub Actions workflows and resulted in a large natural-language prompt being injected into two malicious versions of Trivy’s VS Code extension.

Credentials exfiltrated during the initial incident were used last week in a new supply chain attack that targeted not only the Trivy package but also trivy-action and setup-trivy, Trivy’s maintainers have confirmed in a March 21 advisory.

“Following the initial disclosure on March 1, credential rotation was performed, but was not atomic (not all credentials were revoked simultaneously). The attacker could have used a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days),” the maintainers explain.

The attackers used the compromised credentials to push a malicious Trivy release (version v0.69.4) that was distributed across all regular channels, including GitHub Container Registry, Amazon ECR Public, and Docker Hub.

They also force-pushed 76 of 77 trivy-action version tags to malicious commits, leading to infections with an information stealer designed to dump the Runner.Worker process memory and extract all secrets from it.

The malware was also designed to encrypt the harvested data and send it to a remote server. If the exfiltration failed, it created a public GitHub repository and uploaded the data to it.

Additionally, the attackers targeted the setup-trivy releases, force-pushing all tags to malicious commits, leading to the same infostealer. Socket and Wiz published technical details on the attack and the malware.

No Safe Distance: The Business Impact of Recent Global Developments

The US-Israel-Iran conflict has moved beyond the kinetic battlefield. It is already disrupting the commercial systems and digital services that global businesses rely on.

Since the start of the conflict in late February, it has expanded well beyond governments and militaries, with real consequences now being felt by private companies and the everyday digital infrastructure that underpins global commerce.

That changes who is exposed. When Iran physically struck commercial cloud data centers in the UAE and Bahrain with drones, it sent a clear message that the digital platforms businesses rely on are no longer being treated as separate from strategic targets.

When the pro-Iranian group “Handala” claimed to have destroyed more than 200,000 computers, servers, and mobile devices at a US medical technology firm, it showed that an organization does not need to be directly involved in the conflict to be pulled into it. Handala’s targeting of a major point-of-sale (POS) provider reinforces the same point.

And when hacktivist groups such as “NoName057(16)” and “Keymous+” began announcing distributed denial-of-service (DDoS) targets in protest against Western support of Israel, the objective was not just technical disruption. It was also to create pressure, generate attention, and add a constant stream of noise and reputational risk to an already volatile environment.

Taken together, these developments point to a threat environment that is becoming broader, less predictable, and more willing to use the private sector as a pressure point. It's clear that geopolitical conflict can affect business operations. The question now is how far that pressure spreads across cloud platforms, supply chains, customer relationships, and brand reputation. Business leaders should be preparing not only for attempted intrusions, but for disruption, third-party fallout, and fast-moving incidents that can create operational and reputational consequences at the same time.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!