Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected

Suspected state-sponsored attackers exploited two critical zero-day vulnerabilities in Citrix NetScaler appliances for over three weeks before discovery, targeting dozens of organizations across North America and Europe. The extended dwell time highlights a critical failure in detection and monitoring capabilities for internet-facing network appliances. Attackers leveraged novel tunneler malware for reconnaissance and data theft, demonstrating the sophistication of threats targeting perimeter infrastructure. Zero-day exploitation is particularly dangerous because no patch exists at the time of attack, making robust behavioral monitoring and anomaly detection the last line of defense. This incident underscores that organizations must not rely solely on patch-based defenses for critical edge devices.