a combination of advanced techniques, including spear-phishing campaigns to gain initial access, exploitation of known vulnerabilities (such as CVE-2023-3519 in Citrix NetScaler), and the use of both Commercial Off-The-Shelf (COTS) softwares and legitimate system tools (LOLBINs) for reconnaissance and lateral
Their attack methodology combines initial access through spear-phishing or exploiting vulnerabilities, such as CVE-2023-3519 in Citrix NetScaler, with a series of calculated steps to establish control and execute their ransomware.