By 
A coordinated reconnaissance campaign targeting Citrix NetScaler infrastructure has been observed over the past week, leveraging tens of thousands of residential proxy IPs to identify exposed login panels and gather version information.
The activity occurred between January 28 and February 2 and showed clear signs of organized discovery rather than random internet-wide scanning. Threat intelligence firm GreyNoise attributed the traffic to more than 63,000 unique IP addresses that generated 111,834 scanning sessions, with 79% of the activity directed at Citrix Gateway honeypots.
Approximately 64% of the traffic originated from residential proxies distributed globally, allowing the scanners to appear as legitimate consumer ISP traffic and evade reputation-based filtering. The remaining 36% was traced to a single Microsoft Azure IP address.
According to GreyNoise, the campaign strongly suggests pre-exploitation infrastructure mapping. Researchers highlighted targeted requests for the Citrix Endpoint Analysis (EPA) setup file path as a potential sign of version-specific exploit development or validation against known Citrix ADC vulnerabilities.
The primary indicator of malicious intent involved 63,189 unique IPs generating 109,942 sessions aimed at the Citrix authentication endpoint /logon/LogonPoint/index.html, enabling large-scale identification of exposed login interfaces.
A secondary indicator was observed on February 1, when a focused six-hour scanning burst saw 10 IPs launch 1,892 sessions targeting /epa/scripts/win/nsepa_setup.exe. This activity appeared designed to enumerate Citrix versions through EPA artifacts.
GreyNoise also noted the use of an outdated Chrome 50 user agent, released in 2016, which may have been deliberately chosen to blend in with legacy environments. The speed and precision of the scans suggest a targeted operation potentially triggered by newly identified vulnerable configurations or intelligence on deployment windows.
The activity follows the disclosure of recent critical Citrix vulnerabilities, including CVE-2025-5777, known as CitrixBleed 2, and CVE-2025-5775, a remote code execution flaw previously exploited as a zero-day.
GreyNoise recommends several detection and mitigation measures, such as monitoring for unauthorized blackbox-exporter user agents, alerting on access to EPA setup files, flagging rapid enumeration of Citrix login paths, watching for HEAD requests to Citrix Gateway endpoints, and tracking outdated browser fingerprints.
Administrators are also advised to reassess the exposure of internet-facing Citrix Gateways, restrict access to the /epa/scripts/ directory, disable version disclosure in HTTP responses, and monitor for anomalous access originating from residential ISPs in unexpected regions.
The firm has shared the IP addresses associated with the scanning activity to support defensive efforts.
