Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The attackers deploy web shells mapped to CSS-like URLs to evade detection and create superuser accounts to maintain persistent access. LevelBlue's THOR team identified this malicious activity across multiple customer environments. The exploitation involves theft of configuration data in addition to establishing backdoors. The attack chain leverages the pre-auth vulnerability to gain initial access before dropping post-exploitation payloads. The use of CSS-like URL mappings for web shells represents an evasion technique to blend malicious traffic with legitimate web content.