Wave of Citrix NetScaler Scans Use Thousands of Residential Proxies

Why It Matters

The campaign demonstrates how threat actors use massive residential proxy networks to bypass defenses and map vulnerable Citrix infrastructure, raising the risk of targeted exploits. Organizations must tighten exposure of Citrix gateways to prevent foothold establishment.

Key Takeaways

• Scans used 63,000 residential proxy IPs.
• 79% traffic hit Citrix Gateway honeypots.
• Azure IP contributed 36% of scanning traffic.
• Targeted /logon/LogonPoint and EPA setup paths.
• Recommend restricting internet‑facing gateways.

Pulse Analysis

The recent wave of Citrix NetScaler scans underscores a shift in attacker tactics toward large‑scale, low‑profile probing. By distributing requests across tens of thousands of residential proxies, adversaries can masquerade as ordinary consumer traffic, slipping past reputation‑based firewalls and intrusion‑detection systems. This approach not only inflates the apparent attack surface but also complicates attribution, as the traffic originates from globally dispersed ISP addresses rather than a single malicious node.

Beyond evasion, the focus on specific URL paths—particularly the /logon/LogonPoint authentication endpoint and the EPA setup executable—reveals a strategic intent to harvest version information for exploit development. The use of an outdated Chrome 50 user‑agent further hints at attempts to blend with legacy traffic patterns, while the brief, high‑intensity bursts suggest a timed operation possibly triggered by newly disclosed vulnerabilities like CVE‑2025‑5777. Such precision reconnaissance is a precursor to targeted ransomware or zero‑day attacks, making early detection critical.

Defenders should adopt a layered response: enforce strict access controls on internet‑facing Citrix Gateways, disable version disclosure in HTTP headers, and monitor for anomalous traffic from residential ISP ranges. Implementing alerts for the blackbox‑exporter user‑agent, HEAD requests to gateway endpoints, and rapid enumeration of login paths can provide early warning. As threat actors continue to exploit proxy networks for stealth, organizations must combine threat intelligence with proactive hardening to mitigate the heightened risk to their remote access infrastructure.