The joint advisory explains that the Citrix Bleed vulnerability enables malicious actors to take over legitimate user sessions of Citrix NetScaler web application delivery control and Gateway appliances by bypassing passwords or multifactor authentication. The advisory goes on to note that Citrix Bleed is typically taken advantage of by actors using LockBit, which, as of 2022, was the most deployed type of ransomware around the world, according to CISA. Attackers using LockBit have targeted various organizations across different sectors, including critical infrastructure, government, manufacturing and education. Network defenders should work to detect malicious activity on their systems, the cyber advisory says, adding, "If a potential compromise is detected, organizations should apply the incident response recommendations. If no compromise is detected, organizations should immediately apply patches made publicly available."