Over the previous week, tens of thousands of residential proxies were utilized in a concerted reconnaissance attempt to find login panels on Citrix NetScaler infrastructure.
The activity, which was seen from January 28 to February 2, was centered on listing product versions, suggesting a systematic search for information.
Platform for monitoring threats GreyNoise identified almost 63,000 different IP addresses that initiated 111,834 sessions as the origin of the scanning traffic. The researchers found that Citrix Gateway honeypots were the target of 79% of the traffic.
Approximately 64% of the traffic originated via residential proxies, which are IP addresses dispersed throughout the world that pass for real consumer ISP addresses read more about Wave of Citrix NetScaler scans use thousands of residential proxies.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.