NewsGreyNoise

    Swarming Against Citrix 0-Day Exploitation

    Share
    On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the attack due to it occurring pre-disclosure. However, GreyNoise still detected and labeled the activity as fundamentally malicious within seconds due to behavioral detections.

    Source: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

    ID