God, this one is nasty too... the payload is insta...
# citrix-netscalerr
Ryan Gallier
10/02/2026, 4:15 PMGod, this one is nasty too... the payload is installing a Perl Tunneling Agent. @Richard Faulkner Do you want a copy to send Citrix ?
Ryan Gallier
10/02/2026, 4:16 PMimage.png
r
Richard Faulkner
10/02/2026, 4:19 PMThe IP address is the one identified this morning. Is this something other than that?
r
Ryan Gallier
10/02/2026, 4:19 PMi have the actual payload file
Ryan Gallier
10/02/2026, 4:19 PMthe first files were from the LDAP attack... I now have the payload for the SAML attack
Ryan Gallier
10/02/2026, 4:20 PMit's a binary, so didn't want to just dump it in here
Ryan Gallier
10/02/2026, 4:21 PMnot a binary, sorry, it's a shell script
r
Richard Faulkner
10/02/2026, 4:21 PMOk. Is it not blocked by the recent patch? Is it active and effective right now?
r
Ryan Gallier
10/02/2026, 4:21 PMit's the one rebooting the systems now
Ryan Gallier
10/02/2026, 4:22 PMwell, let me be more clear.. the attacker is using the SAML exploit to TRY and push this .sh file
Ryan Gallier
10/02/2026, 4:22 PMCitrix needs to see it, imo
r
Richard Faulkner
10/02/2026, 4:22 PMGot it. Citrix is sending out an urgent email with the steps identified in the previous post about adding the responder policy.
r
Ryan Gallier
10/02/2026, 4:23 PMSure, but i'm sure they would want to know the payload?
Ryan Gallier
10/02/2026, 4:54 PM@Thomas Poppelgaard Yup, did that here. 🙂
h
Henry Heres
10/02/2026, 5:32 PMwhen will the mail come?
r
Richard Faulkner
10/02/2026, 5:42 PMUknown @Henry Heres
j
Jeff Riechers
10/02/2026, 7:47 PM