Massive Reconnaissance Campaign Targets Citrix ADC and NetScaler Gateways Using 63,000 Residential Proxies

GreyNoise has detected a coordinated reconnaissance campaign targeting Citrix ADC and NetScaler Gateways between January 28 and February 2, 2026. The attackers used more than 63,000 residential proxies to discover login panels and enumerate versions. The campaign then shifted to AWS infrastructure. The operation was conducted in two distinct modes, combining massive use of residential proxies for the initial discovery phase before migrating to AWS cloud resources.