NetScaler Honeypot

TrustedSec observed exploitation of Citrix NetScaler RCE (CVE-2019-19781) against a honeypot: attackers used directory traversal and the Project India exploit to run commands, installed cron-based downloaders (ci.sh / ci3.sh) that ensure persistence, deployed an XMRig Monero miner (netscalerd), and delivered a Go-based backdoor (nspps) with scanning and backconnect capabilities; the report includes logs, defanged scripts, file hashes, and IP/domain indicators of compromise.