Rob Joyce on Twitter: "Active exploitation Citrix devices underway by APT5. @NSACyber threat hunting guidance linked below to identify and remediate this activity. Update to the latest Citrix release, check for compromise, and let us know if you find anything. https://t.co/7KeEX3i4gp" / Twitter
https://twitter.com/nsa_csdirector/status/1602639460751101952