Coordinated Global Reconnaissance Targeting Citrix Gateways

Du'aine Davis

Observed in the wild

• Between 28 January and 2 February 2026, GreyNoise observed a coordinated reconnaissance campaign against Citrix ADC/Netscaler Gateways, logging 111,834 sessions. Organisations running internet‑facing Citrix Gateway infrastructure are the primary targets and should treat this as a credible precursor to exploitation.
• The campaign used two modes: a massive login panel discovery sweep via 63,000+ residential proxy IPs and Azure, and a 6‑hour version enumeration sprint from 10 AWS sources all sharing consistent fingerprints. Indicators included Prometheus blackbox‑exporter user agents, single‑use residential IPs, outdated Chrome 50 fingerprints, and targeted access to /epa/scripts/win/nsepa_setup.exe. The infrastructure separation suggests operational compartmentalisation but common tooling.
• Organisations are advised to monitor for: unauthorised blackbox-exporter user agents, external hits to /epa/scripts/ paths, rapid enumeration of /logon/LogonPoint/, anomalous residential ISP traffic, and legacy browser fingerprints. Recommended actions include restricting or authenticating access to EPA directories, suppressing Citrix version disclosure, reviewing internet exposure, and adding alerts in Microsoft Defender for suspicious HTTP probing, HEAD request bursts, and traffic from listed AWS/Azure IPs or unexpected geographies.

How fake party invitations are being used to install remote access tools | Malwarebytes