Reconnaissance Campaign Targets Citrix Gateways Using 63K+ Proxies

Between January 28 and February 2, 2026, GreyNoise tracked a coordinated reconnaissance campaign targeting Citrix ADC and NetScaler Gateways. Attackers utilized over 63,000 residential proxies and AWS infrastructure to discover login panels and enumerate software versions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has noted this activity as part of ongoing threats to these systems.