Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

Threat actors, likely state-sponsored, exploited two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to gain root-level access and deploy persistent web shells across government and financial organizations. Because these were zero-days, no patch existed at the time of initial exploitation, making rapid detection and compensating controls the only viable defense. The weeks-long exploitation window highlights critical gaps in monitoring internet-facing infrastructure and lateral movement detection. Organizations relying on perimeter appliances as trusted network entry points without deeper inspection create high-value, high-risk attack surfaces that are increasingly targeted by advanced adversaries.