The post-exploitation activity was observed across multiple customer environments, where attackers leveraged the flaw to gain a foothold without needing valid credentials. Once inside, the attackers dropped a payload designed to accomplish two notable objectives:

• Creating a superuser account on the compromised appliance, granting persistent privileged access.
• Deploying a web shell that maps to CSS-like URL paths, a technique that helps the malicious endpoint blend in with legitimate static asset requests and evade casual inspection.

LevelBlue's THOR team identified the malicious NetScaler activity while reviewing exploitation attempts across the affected customer environments. The campaign underscores how quickly attackers move from initial access to establishing persistence once a pre-auth command injection flaw is exploited in edge-facing appliances.

The article does not provide a specific CVE ID, affected version list, or indicators of compromise, so no such identifiers are included here. Organizations running NetScaler ADC or NetScaler Gateway should treat this as a reminder to review exposure of management interfaces, audit local accounts for unexpected superuser creation, and inspect web server logs for suspicious requests to CSS-like paths.

Source: The Hacker News

Has your organization reviewed its NetScaler appliances for signs of this post-exploitation activity, and what steps are you taking to detect or remove unauthorized superuser accounts?