Citrix NetScaler PostExploitation Payload Creates Superuser Maps Web Shell to CSSLike URLs

Threat actors have been observed exploiting a critical preauthentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data LevelBlues Threat Hunt Operations Research THOR team which analyzed the exploitation activity across multiple customer environments said it identified malicious NetScaler