id: 3362
uid: EVWqT
insdate: 2026-10-01 05:10:05
title: Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
additional: Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data.

LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler
category: Cybersecurity
md5:
guid: https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
source_url: https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
updated:
image:
author_name:
author_link: