Loading story…
GreyNoise reported a coordinated, large-scale reconnaissance campaign targeting Citrix ADC Gateway / NetScaler Gateway infrastructure observed from Jan 28 to Feb 2, 2026, consistent with pre-exploitation mapping of exposed systems. The activity generated 111,834 scanning sessions from 63,000+ unique IPs, with ~79% of traffic aimed at Citrix Gateway honeypots—well above typical background scanning—indicating deliberate targeting rather than opportunistic crawling.
The operation used two complementary modes: (1) broad login panel discovery against /logon/LogonPoint/index.html driven largely by residential proxy rotation (with additional traffic attributed to Azure), and (2) a short, concentrated version-enumeration burst from 10 AWS-hosted IPs targeting /epa/scripts/win/nsepa_setup.exe (an EPA artifact) to infer product versions for exploit validation or version-specific exploit development. Researchers noted attacker tradecraft such as an older Chrome 50 user agent and the tight timing/coordination of the two scan types, aligning with patterns seen ahead of exploitation of known Citrix ADC weaknesses.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
On February 3, 2026, GreyNoise's findings were publicly reported, attributing the activity to a dual-mode reconnaissance effort using residential proxies and AWS infrastructure. The report assessed the scanning as likely preparatory work for exploitation of known Citrix weaknesses and shared detection and hardening guidance.
GreyNoise observed the reconnaissance campaign through February 2, 2026, recording 111,834 sessions from more than 63,000 unique IP addresses, with 79% of activity aimed at Citrix Gateway honeypots. The pattern indicated deliberate infrastructure mapping rather than routine internet background scanning.
On February 1, 2026, the campaign included a short, intense AWS-hosted scanning burst focused on the Citrix Endpoint Analysis (EPA) setup file path to infer exposed product versions. The activity used uniform HTTP fingerprints and an outdated Chrome 50 user agent, suggesting automated tooling for pre-exploitation mapping.
A large-scale reconnaissance operation targeting Citrix ADC/NetScaler Gateway infrastructure began on January 28, 2026. Attackers used tens of thousands of residential proxy IPs, along with some cloud infrastructure, to identify exposed Citrix login panels at scale.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GreyNoise telemetry indicates that exploitation of **CVE-2025-55182** in **React Server Components** has shifted from broad, opportunistic scanning to concentrated, high-volume campaigns. The flaw is described as **pre-authentication RCE** with a **CVSS 10.0** and can be triggered via a single malicious **HTTP POST** request, making exposed development servers (notably on ports **3000–3002** in addition to 80/443) attractive targets. Between **Jan 26 and Feb 2, 2026**, GreyNoise observed **1,083** unique sources attempting exploitation, but **two IPs accounted for 56%** of observed activity, suggesting industrialized automation rather than ad-hoc testing. Reporting attributes **34%** of sessions to `193.142.147[.]209`, associated with payloads that open **reverse shells** back to the scanning host (including use of port **12323**), indicating intent for interactive access and potential follow-on pivoting. Another **22%** is attributed to `87.121.84[.]24`, linked to **cryptomining** activity (e.g., downloading **XMRig** from staging infrastructure); one cited staging host is `205.185.127[.]97`, associated with attacker-controlled domains (e.g., `mased[.]top`, `mercarios[.]buzz`) and adjacent subnet activity reportedly distributing **Mirai**. Separately, GreyNoise also reported a distinct reconnaissance campaign against **Citrix NetScaler/Gateway** using **tens of thousands of residential proxy IPs** to enumerate login panels and version artifacts (e.g., `/logon/LogonPoint/index.html` and `/epa/scripts/win/nsepa_setup.exe`), which appears to be pre-exploitation mapping and is not directly tied to the React CVE activity.
Jun 29, 2026
Attackers continued to target Citrix NetScaler ADC and NetScaler Gateway systems vulnerable to **`CVE-2025-5777`**, a critical flaw also dubbed **Citrix Bleed 2** that can let unauthenticated attackers obtain sensitive information and hijack user sessions. The vulnerability affects NetScaler deployments configured as described in Citrix’s security bulletin, and public advisories warned that exploitation could also enable arbitrary file reads, broader information disclosure, and denial of service on exposed appliances. SOC telemetry showed exploitation attempts persisted well beyond initial disclosure, with detections recorded from mid-July through September 2025 rather than a brief spike. One observed pattern used a `POST` request to `/p/u/doAuthentication.do` with an unusually long `User-Agent` header to retrieve memory data, while much of the attack traffic was traced to infrastructure in the United States and France. Citrix and national defenders urged organizations to identify affected NetScaler ADC and Gateway versions and apply the vendor’s fixed releases immediately.
Aug 21, 2026
Attackers widely exploited **CVE-2023-4966** (`Citrix Bleed`), a critical flaw in **NetScaler ADC** and **NetScaler Gateway** that can leak sensitive information, including session authentication tokens, and enable authentication bypass or session hijacking on affected Gateway or AAA virtual servers. Citrix issued a critical security update and later published investigation recommendations, while defenders reported attack activity beginning in late October and rising sharply through November. One observed technique targeted `/oauth/idp/.well-known/openid-configuration` with an unusually long `Host` header to steal session cookies, and a large share of detected attack traffic was traced to infrastructure in Germany, followed by Russia, China, Japan, and the United States. The vulnerability was later tied to real-world intrusions, including a **PLAY ransomware** compromise of a professional services firm. After obtaining access through Citrix Bleed, the attackers performed internal reconnaissance to enumerate domain accounts, trusted domains, permission groups, and remote systems before advancing their operation. Security guidance urged organizations running affected NetScaler products, including unsupported `12.1` versions, to apply fixed releases immediately and investigate for signs of token theft or unauthorized session use.
Aug 15, 2026