GreyNoise tracks massive Citrix Gateway recon using 63K+ residential proxies and AWS

Securityaffairs.Co •Pierluigi Paganini • February 4, 2026

GreyNoise spotted a dual-mode Citrix Gateway recon campaign using 63K+ residential proxies and AWS to find login panels and enumerate versions. Between Jan 28 and Feb 2, 2026, GreyNoise tracked a coordinated reconnaissance campaign targeting Citrix ADC and NetScaler Gateways. Attackers used over 63,000 residential proxies to discover login panels, then switched to AWS infrastructure […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Reconnaissance Campaign Targets Citrix Gateways Using 63K+ Proxies Between January 28 and February 2, 2026, GreyNoise tracked a coordinated reconnaissance campaign targeting Citrix ADC and NetScaler Gateways. Attackers utilized over 63,000 residential proxies and AWS infrastructure to discover login panels and enumerate software versions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has noted this activity as part of ongoing threats to these systems. 2 sources 20

Extracted Entities

GreyNoise tracks massive Citrix Gateway recon using 63K+ residential proxies and AWS

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)