Citrix NetScaler Gateway zero-day exploitation attempt observed by GreyNoise from 149.104.78.141 with webshell post-exploitation
On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to …