NorthLedger's internet-facing NetScaler gateway, NL-NSGW-01, has been identified as potentially compromised.

An acquisition has been collected from the appliance containing NetScaler logs, web server logs, configuration files, selected filesystem artefacts, live-response output and limited network telemetry.

Your task is to determine what happened to the appliance, identify how the attacker maintained access and establish whether the compromised gateway was subsequently used to reach systems inside the NorthLedger network.