/
← Voltar ao feed
critical

Citrix NetScaler Gateway zero-day exploitation attempt observed by GreyNoise from 149.104.78.141 with webshell post-exploitation

1 fonte(s) · 1 atualização(ões) · publicado 27/09/2026 21:00 · coletado há 1 dia

On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to gain a foothold, yet it exposed the actor's post-exploitation playbook, which centered on root escalation and a hidden, cookie-controlled webshell. GreyNoise is withholding the exploitation chain details, says patches are available, and notes that further indicators are shared in the community at a higher TLP level. The vulnerability allows log poisoning with variable payloads, so published indicators should not be treated as exhaustive.

Technical Details

  • The actor tried to set the setuid and setgid bits on /bin/sh to obtain a root shell.
  • It then tried to install a password-protected webshell that accepts commands via a cookie value, possibly to avoid persisting commands in web logs.
  • The webshell was a hidden dot file, .ctxs.receiver, which the actor tried to configure the web server to treat as PHP despite the missing .php extension.
  • An alias was meant to route requests for the non-existent receiver.min.css to .ctxs.receiver. An additional AliasMatch rule would match receiver.min.[0-9a-f].css paths with variable characters.
  • Finally, the actor tried to kill the httpd process to force a server restart.
  • Adversaries have many options to poison server logs with variable malicious payloads during exploitation.

Remediation

  • Apply the available Citrix patches for NetScaler Gateway.
  • Hunt for .ctxs.receiver, unexpected alias or AliasMatch directives referencing receiver.min CSS paths, and setuid/setgid bits on /bin/sh.
  • Review web server configuration changes and unexpected httpd restarts.
  • Block or monitor the listed source IP, without relying on it as an exhaustive indicator.

Linha do tempo

  1. greynoise.io ↗ · pub. 27/09/2026 21:00 · coletado 19/10 18:37 primeiro registro

    Citrix NetScaler Gateway zero-day exploitation attempt observed by GreyNoise from 149.104.78.141 with webshell post-exploitation

    ler a análise desta fonte

    On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to gain a foothold, yet it exposed the actor's post-exploitation playbook, which centered on root escalation and a hidden, cookie-controlled webshell. GreyNoise is withholding the exploitation chain details, says patches are available, and notes that further indicators are shared in the community at a higher TLP level. The vulnerability allows log poisoning with variable payloads, so published indicators should not be treated as exhaustive.

    Technical Details

    • The actor tried to set the setuid and setgid bits on /bin/sh to obtain a root shell.
    • It then tried to install a password-protected webshell that accepts commands via a cookie value, possibly to avoid persisting commands in web logs.
    • The webshell was a hidden dot file, .ctxs.receiver, which the actor tried to configure the web server to treat as PHP despite the missing .php extension.
    • An alias was meant to route requests for the non-existent receiver.min.css to .ctxs.receiver. An additional AliasMatch rule would match receiver.min.[0-9a-f].css paths with variable characters.
    • Finally, the actor tried to kill the httpd process to force a server restart.
    • Adversaries have many options to poison server logs with variable malicious payloads during exploitation.

    Remediation

    • Apply the available Citrix patches for NetScaler Gateway.
    • Hunt for .ctxs.receiver, unexpected alias or AliasMatch directives referencing receiver.min CSS paths, and setuid/setgid bits on /bin/sh.
    • Review web server configuration changes and unexpected httpd restarts.
    • Block or monitor the listed source IP, without relying on it as an exhaustive indicator.