2 new forms of malware exploited Citrix Netscaler devices one month before patch

Mandiant Consulting and the Google Threat Intelligence Group (GTIG) on September 29 reported that two novel forms of malware were actively exploiting Citrix NetScaler ADC and NetScaler Gateway appliances and gaining root access roughly a month before a patch existed.

The researchers said, based on the team’s observations, there’s evidence organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted.

This news broke not long after the Cybersecurity and Infrastructure Security Agency (CISA) added two Citrix Netscaler zero-day bugs to its known exploited vulnerabilities (KEV) catalog, CVE-2026-88771 and CVE-2026-88772.

The GTIG research from September 29 focused on CVE-2026-88772, which security experts say suggests there are separate threat actors with very different objectives hitting the same product through different doors. The initial reporting focused on CVE-2026-88771 because it affects default configurations across all NetScaler deployments.

However, Denis Calderone, chief technology officer at Suzu Labs, pointed out that the Mandiant/GTIG research showed CVE-2026-88772 reveals something qualitatively different: While 88771 has a very broad scope and it’s technically every bit as bad as 88772, Mandiant/GTIG showed that suspected state-sponsored actors have been exploiting that Datagram Transport Layer Security (DTLS) memory overflow since at least September 3, nearly a month before patches existed, using novel malware.

That malware has caught the attention of security researchers: WHIPSHOT, a PHP web shell disguised as a Debian package file that hides command traffic inside HTTP request headers and returns fake 404 responses, and SLAPSHOT, a Python tunneler that bridges the compromised NetScaler appliance directly into the internal network for reconnaissance and credential theft.

Here's how the malware works: attackers gain initial access via the vulnerability CVE-2026-88772, which uses malformed DTLS handshake fragments to overflow a heap buffer in the NetScaler Packet Processing Engine. It causes one component to crash but also allows root-level code execution on the FreeBSD OS.

A dropper then lands, establishing persistence. It’s a lightweight "installer" web shell that modifies /etc/httpd.conf so the web server treats non-script file types (.deb, .sig, .ico) as executable PHP.

Finally, WHIPSHOT gets deployed: a PHP web shell that’s disguised as a .deb file sitting in the VPN scripts directory. It receives commands hidden in HTTP request headers, decodes them from Base64, and forwards them to SLAPSHOT over a local loopback connection. The malware returns simple fake 404 responses, so to internal admins, nothing appears in the logs.

SLAPSHOT can be thought of as a Python-based TCP tunneler, said Calderone, who added that this tool lets the attacker tunnel through the NetScaler appliance into the internal network, which allows for lateral movement.

“This is purpose-built espionage tooling designed to persist and evade, and Mandiant/GTIG confirmed the actors used it to move laterally and steal credentials in at least one intrusion,” said Calderone. “This is reminiscent of CitrixBleed in 2023. After initial discovery and patching of that threat we saw that LockBit was using the same vulnerability class to hit ICBC, Boeing, and DP World. Mandiant is warning to expect broad opportunistic exploitation in the near term, and I would have to agree with that assessment.”

Alex Wells, head of product strategy at Hadrian, pointed out that disclosure often only represents the beginning of an investigation. When these vulnerabilities were first disclosed, CVE-2026-88771 understandably attracted significant attention because it affects NetScaler appliances in their default configuration and exploitation is comparatively straightforward. 

Wells said what Google and Mandiant uncovered was not simply scanning or opportunistic exploitation; their investigation found attackers gaining root access, establishing persistent web shells and deploying previously unseen tooling to reach further into victims’ internal networks for reconnaissance and credential theft.

“Security teams often have to make decisions based on incomplete evidence, and a vulnerability that initially appears most concerning is not necessarily the one that represents the greatest business risk,” said Wells.

Justin Moore, director of adversary research at Arctic Wolf, said this case reminds us that initial hot takes can age quickly once responders have time to dig deeper. With vulnerabilities like these, Moore said there’s often a massive wave of scanning and exploitation activity that creates a lot of noise in the early stages of an investigation, some of it originating from bug bounty researchers and automated vulnerability scanners. And, as responders collect new telemetry and forensic evidence, Moore said each finding becomes a new pivot point that can reveal activity that was not previously visible.

“It’s important to remember that incident response is an iterative process,” said Moore. “Vendor-side responders are often dependent on the visibility available within affected customer environments, and we’re piecing together the story from the evidence available at a given point in time. As additional data emerges across multiple investigations, our understanding of the scope, timeline, and tradecraft can change significantly. That’s not necessarily a sign that an initial assessment was wrong, but more a reflection of how complex investigations evolve as new evidence comes to light."

Shane Barney, chief information security officer at Keeper Security, added that Mandiant and GTIG's report means attackers have had weeks to gain root access, plant persistent web shells, and establish footholds inside enterprise networks before most organizations even knew the vulnerabilities existed.

“The patch Citrix released closes the vulnerability, but it does not remove the attackers who established persistence before the patch was applied,” said Barney. “This is where many organizations falter: they apply the code, declare the problem solved, and move on, even if attackers are still inside the network.”

Barney said organizations need to treat patching as the beginning of the investigation rather than the end: that means pulling logs to understand who accessed what and when, reviewing credential usage to identify behavior that doesn't match normal patterns, and hunting actively for signs of lateral movement.

“Security teams must understand what privileged access attackers can obtain once they’ve compromised the network,” said Barney. “Without visibility into who can access what and without monitoring privilege use in real-time, defenders won't know an attacker is abusing credentials until the damage has already been done. The longer organizations wait to hunt and the longer they operate without visibility into privilege, the greater the opportunity for an attacker to become embedded.”