Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

A critical Citrix NetScaler zero-day campaign is actively being used with custom malware to gain persistent access, proxy traffic into internal networks, and steal credentials, with confirmed targeting across government, financial services, education, legal, and professional services organizations in North America and Europe. For CIOs and technology leaders, this is a reminder that internet-facing edge appliances are now high-value attack paths: patching is necessary but insufficient, and IT teams must assume potential compromise, prioritize detection, and be prepared for incident response on these devices before normal remediation.