Cybersecurity
NetScaler attackers create superuser and web shell
LevelBlue said attackers exploited a Citrix NetScaler command-injection flaw to run commands, fetch payloads, collect configuration data, create a superuser account and place a web shell on affected appliances.
- LevelBlue said its THOR team found malicious authentication events on Citrix NetScaler ADC and NetScaler Gateway appliances tied to CVE-2026-88771.
- The company said some attempts used curl or wget to fetch payloads or collect NetScaler configuration data.
- LevelBlue said update_c08937.pl added a local sec_monitor account with superuser rights, archived /flash/nsconfig, uploaded the archive and removed traces.
- The disclosure followed reports that NCSC-NL had warned organisations about active exploitation, and Mandiant Consulting with GTIG later said dozens of organisations were hit through CVE-2026-88772.
LevelBlue's Threat Hunt Operations & Research team said it had seen malicious authentication events on Citrix NetScaler ADC and NetScaler Gateway appliances. It linked the activity to CVE-2026-88771, which it described as an input-validation flaw that could let an unauthenticated attacker run commands.
The company said some attempts used whoami checks, while others used curl or wget to download payloads or gather NetScaler configuration data. It listed 64.94.85[.]67:443, 31.56.197[.]72:9090 and 23.27.143[.]20:9000 as addresses involved in the activity.
One payload, main.py, was a Python script that tried to open a reverse shell to 45.141.21[.]130 on TCP port 443. LevelBlue said it also looked for /var/python/bin/customsnmpd processes and killed them with kill -9.
Another payload, update_c08937.pl, was a Perl script that edited /flash/nsconfig/ns.conf to add a sec_monitor account with superuser rights, archived /flash/nsconfig, uploaded the archive, changed /bin/sh permissions and deployed a PHP web shell at /var/netscaler/logon/LogonPoint/.local_journal. It also modified /etc/httpd.conf so the shell could be reached through URLs resembling NetScaler CSS resources.
The disclosure followed reports that NCSC-NL had sent a pre-notification in the Netherlands urging organisations to shut appliances down because of active exploitation. Mandiant Consulting and Google Threat Intelligence Group later said dozens of organisations had been affected by attacks using CVE-2026-88772 to deliver WHIPSHOT and SLAPSHOT.
Named in this story
Companies
- LevelBlue
- said it analysed the exploitation activity across multiple customer environments
- GreyNoise
- corroborated the activity that mapped the web shell to CSS-like URLs
- Mandiant Consulting
- said dozens of organisations had been affected
Organisations
- Threat Hunt Operations & Research (THOR) team
- identified the malicious authentication events
- Google Threat Intelligence Group (GTIG)
- said dozens of organisations had been affected
Governments and agencies
- Dutch National Cyber Security Centre (NCSC-NL)
- reportedly sent a pre-notification urging organisations to shut appliances down
Products and systems
- Citrix NetScaler ADC
- was one of the affected appliances
- Citrix NetScaler Gateway
- was one of the affected appliances
- main.py
- was the Python payload used to establish a reverse shell and kill processes
- update_c08937.pl
- was the Perl payload used to add an account, archive configuration data and deploy a web shell
- WHIPSHOT
- was a PHP web shell delivered in attacks exploiting CVE-2026-88772
- SLAPSHOT
- was a Python tunneller delivered in attacks exploiting CVE-2026-88772
How the source tells it
The article used a restrained, forensic register and did not lean on emotive framing.
No emotive framing was found in the original.