State-backed groups exploited Citrix NetScaler zero-day for 3+ weeks undetected

Mandiant reports that advanced, suspected state-sponsored threat actors exploited a Citrix NetScaler zero-day for at least three weeks before detection, impacting dozens of organizations. The full scope of compromise remains unclear, and Mandiant expects further attacks. This highlights a persistent vulnerability in widely deployed edge infrastructure, posing ongoing risk to affected networks.