Swarming Against Citrix 0-Day Exploitation

Summary: On 24 September 2026, an actor using 149.104.78.141 attempted zero-day exploitation against a Citrix NetScaler Gateway, detected by a Project Swarm participant sensor before any CVE-specific detections existed. The attempt failed to gain a foothold, but the actor tried to set setuid and setgid bits on /bin/sh for a root shell, install a cookie-authenticated password-protected webshell hidden as a dot file, alias a fake CSS path to it, and kill httpd to restart the server.
What you should know: GreyNoise flagged the activity as malicious within seconds on behavior alone, because at the time no signature existed for the vulnerability - the detection gap between exploit and disclosure is where this actor operated. The playbook also hides commands from web logs and lets adversaries poison server logs with variable payloads, so log-based investigation of a Citrix NetScaler compromise may not show what happened.

Read the original at GreyNoise Blog ↗