Cybersecurity
Citrix NetScaler zero-days used to deploy web shells
Mandiant, GreyNoise and Citrix said attackers exploited two NetScaler flaws in separate intrusions, used web shells and tunnelling malware, and sought root access, credentials and lateral movement.
- Mandiant said the campaign began in at least early September and affected organisations in North America and Europe across several sectors.
- Citrix disclosed CVE-2026-88771 and CVE-2026-88772 on Sunday and said both had been exploited on unmitigated deployments.
- GreyNoise said it saw an attempt on 24 September to alter /bin/sh and place a password-protected PHP shell before public CVE detections were available.
- Mandiant said the attackers used the web shells and the SLAPSHOT tunnelling tool, while naming WHIPSHOT and SLAPSHOT as new malware families.
- Mandiant said installing the latest security updates was the only way to address both flaws, and advised DTLS shutdown or inbound UDP/443 blocking only as temporary measures for CVE-2026-88772.
The campaign became public over the weekend after Citrix administrators said suppliers, security teams, CERTs and national cyber agencies had privately warned organisations about two unpatched NetScaler flaws, and in some cases told them to take affected appliances offline. Mandiant later said the activity had started by early September and had reached organisations across North America and Europe.
Citrix then disclosed CVE-2026-88771 and CVE-2026-88772 on Sunday and said both had been used against systems that had not been mitigated. The company said one flaw allowed unauthenticated remote code execution across NetScaler ADC and Gateway deployments, while the other could lead to remote code execution or denial of service when DTLS was enabled.
GreyNoise said it had seen a threat actor on 24 September try to exploit a Citrix NetScaler Gateway from 149.104.78.141, before its platform had CVE detections available. It said the attacker tried to alter /bin/sh for a root shell, drop a password-protected PHP web shell and change web server settings so requests for harmless-looking files would open the shell.
Mandiant said the exploit bypassed authentication, caused the NSPPE to crash and gave attackers root access on the appliance. It said the operators then hid PHP web shells behind file types such as .deb, .sig and image files, used fake 404 responses, and deployed WHIPSHOT and SLAPSHOT to proxy requests and tunnel into internal hosts.
Google said it had seen attackers use the proxy in at least one intrusion to look around and steal credentials, and Mandiant said the group also changed /bin/sh permissions to keep root-level execution. It said defenders should install the latest Citrix updates and check for indicators including altered httpd.conf entries, suspicious files under /tmp and unusual Python processes.
Named in this story
Companies
- Citrix
- disclosed the flaws and issued security updates
- Mandiant
- said the attacks began in early September and described the intrusions
- GreyNoise
- observed an exploit attempt on 24 September and documented attacker actions
- watchTowr
- said it verified exploitation of two NetScaler zero-days
Organisations
- Google Threat Intelligence Group
- analysed telemetry and described shellcode execution on FreeBSD
Products and systems
- NetScaler ADC and Gateway
- the affected appliance line targeted by the attacks
- NetScaler Packet Processing Engine (NSPPE)
- terminated unexpectedly when the exploit ran
- WHIPSHOT
- a previously undocumented PHP web shell used in the campaign
- SLAPSHOT
- a previously undocumented Python tunnelling tool used after compromise
- FreeBSD
- the underlying platform cited in the exploit analysis
Places
- North America
- a region where organisations were said to be affected
- Europe
- a region where organisations were said to be affected
How the source tells it
Mostly a technical incident report, with urgency from mitigation advice and repeated emphasis on root access, credential theft and lateral movement.
- urgency mitigation guidance and the claim that patching was the only way to cover both flaws
- threat descriptions of root-level access, credential theft and movement into internal networks