GreyNoise on Mythryl: “On September 24, GreyNoise observed zero-day exploitation attempts…”

On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.

greynoise.ioSwarming Against Citrix 0-Day ExploitationOn 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the ...

28/9/26, 5:20 pm0 reposts2 likes

Post