Incident Response Checklist

🚨 Immediate Actions (0-24 hours)

Isolate the compromised Citrix NetScaler Gateway appliance.
Block outbound traffic to the domain aar.gandhibludtric[.]com and IP 38.54.63[.]75.
Disable VPN access for SoftEther VPN service temporarily.
Alert all relevant stakeholders about the intrusion.
Initiate enhanced monitoring for unusual activity on Citrix Virtual Delivery Agent hosts.

🔄 Recovery Actions

Rebuild compromised systems from clean backups.
Restore normal VPN operations with enhanced security measures.
Conduct a full security review of Citrix and other edge devices.
Re-enable access to critical systems with additional access controls.