Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors are exploiting a critical vulnerability in Citrix NetScaler to inject commands and drop web shells. This exploitation allows them to attempt theft of configuration data. The vulnerability is pre-authentication, meaning it can be exploited without needing to log in first. A research team analyzed this activity across multiple environments and identified malicious NetScaler activity. The exploitation results in the creation of a superuser and maps a web shell to specific URLs. The team from LevelBlue's Threat Hunt Operations and Research made these observations.