Citrix NetScaler Exploit Deploys Superuser and CSS-Like Web Shells

Threat actors are actively exploiting a critical pre-authentication command injection flaw in Citrix NetScaler ADC and Gateway. The post-exploitation activity involves creating rogue superuser accounts and dropping web shells disguised as CSS URLs to steal configuration data. Administrators must patch immediately and audit environments for unauthorized administrative accounts.