Attributed metadata history
Up to 100 retained publisher events per page for 671f1b2e5787fc52effa58c4a1592996ecfa9ad042fa84aff03a65d61b7c4fd6. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
available
Fingerprint: e71aa6d523741f9f527f5071fd96527dbb781bc01e36c89fd9ec28cdb29f734f
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. We have observed evidence that organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted by this exploitation campaign, which has been ongoing since at least early September. According to vendor disclosures, threat actors are also actively exploiting a second zero-day vulnerability (CVE-2026-88771). Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine (NSPPE) to establish initial root-level access. Analysis of the actor’s post-exploitation toolkit reveals newly discovered custom PHP web shells, such as WHIPSHOT, capable of disguising Base64-encoded command-and-control (C&C) payloads within native HTTP headers. The toolkit also includes a novel companion Python tunneler, SLAPSHOT, capable of proxying traffic into internal networks for
Fingerprint: bfb57585a4e9fbd3a45576fd52247286c8880d80e48446de70895863371901f0