Image: cdn.prod.website-files.com · rights & removal

Swarming Against Citrix 0

Reporting by GreyNoise BlogRead the original at greynoise.io

Executive Summary

A malicious cyber actor attempted to exploit a Citrix NetScaler Gateway using an IP address of 149.104.78.141 on September 24, 2026. Because the attack occurred before any CVE disclosures, no specific detections existed for the exploitation method itself. GreyNoise detected and labeled the activity as malicious based on behavioral analysis in seconds. Although the adversary failed to establish a foothold on the target sensor, their subsequent post-exploitation actions were observed. These actions involved attempting to gain root access by setting setuid and setgid bits on /bin/sh, installing a password-protected webshell, modifying configuration files to treat a file without a .php extension as a PHP script, creating aliases for non-existent CSS files to route traffic to the webshell, and finally, attempting to terminate the httpd process.

Facts Only

* A malicious cyber actor used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway on September 24, 2026.
* GreyNoise detected and labeled the activity as malicious based on behavioral detections.
* The adversary attempted to set the Set User ID (setuid) and Set Group ID (setgid) bits on /bin/sh to obtain a root shell.
* The adversary attempted to install a password-protected webshell.
* The adversary attempted to configure the web server to treat a file named .ctxs.receiver as a PHP file, despite lacking a .php extension.
* The adversary attempted to create an alias to route requests for a non-existent CSS file (receiver.min.css) to .ctxs.receiver.
* The adversary attempted to create an AliasMatch setting to allow flexible pattern matching for the webshell path.
* The adversary attempted to kill the httpd process to restart the server.
* Command sequence included: chmod 6555 /bin/sh, creating a directory structure, writing content into .ctxs.receiver, injecting shell commands via input redirection and command execution calls, and modifying configuration files to introduce webshell functionality.

Full Take

The observable behavior reveals a sophisticated post-exploitation methodology focused on persistence and obfuscation rather than direct system compromise resulting from the initial zero-day attempt. The adversary bypassed immediate detection by leveraging file system manipulations and dynamic configuration overrides, suggesting an understanding of underlying server logic (specifically HTTPD aliases) to establish a covert communication channel via a webshell hidden within unusual file naming conventions. The pattern of attempting to manipulate execution contexts (`setuid/setgid`), exploit file interpretation rules, and configure web server handlers indicates an intent to establish a persistent, low-level foothold that evades standard log monitoring by hiding command execution artifacts in dynamically named files. This process mirrors known adversary tradecraft where the goal shifts from initial access to establishing a stable, stealthy remote execution mechanism. The fact that post-exploitation details were revealed suggests a focus on documenting the method of persistence as much as the vulnerability itself, which is an important signal regarding operational security goals.
Bridge Questions: How does the context of observing this activity before a CVE disclosure influence the perceived severity versus the operational goal of the adversary? What are the systemic implications when observed behavior reveals specific obfuscation techniques across various systems? What risks do these post-exploitation persistence methods introduce for standard security monitoring tools?

From the original · GreyNoise Blog

GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation.

Read the full story at greynoise.io

Sentinel — Human

Confidence

The text reads like a technical security blog post providing specific operational details, exhibiting high domain specificity but with enough narrative framing to suggest human authorship within the security community context.

Signals Detected

Sentence length variance shows some natural variation; the technical code snippets disrupt a uniform rhythm.

The text flows logically from observation to post-exploitation details, characteristic of threat reporting.

The inclusion of specific, complex shell commands and file manipulation demonstrates deep domain knowledge often found in internal security reporting rather than generic AI summaries.

The specific technical steps (e.g., setting setuid/setgid bits, manipulating Apache configuration directives) appear highly granular and specific, suggesting direct involvement or high-fidelity source material.

Human Indicators

The presentation mixes high-level observation with extremely detailed, technical exploitation steps (shell commands, file modifications), which is typical of security researchers reporting findings.