Arctic Wolf details post-exploit NetScaler attacks

JOSEPH GABRIEL LAGONSIN

News Editor

Arctic Wolf Labs has published threat intelligence on attacks exploiting Citrix NetScaler vulnerabilities, based on activity observed on compromised devices.

The research examines what intruders did after gaining access to vulnerable NetScaler appliances, shifting the focus from the software flaws themselves to post-exploitation behaviour on affected systems.

Researchers observed command injection and remote code execution activity targeting exposed devices. They also documented the retrieval and execution of malicious Python, Perl and shell scripts, along with attempts to establish reverse-shell access and run remote commands.

The report also identifies persistence measures designed to remain in place after remediation begins. That suggests some organisations may need to do more than install updates if attackers had already…