NetScaler Zero-Day Campaign Used Web Shells and Tunneling Tool to Breach Networks
Summary
Mandiant and GTIG say attackers exploited NetScaler zero-days since at least early September, gaining root access and using web shells and a tunneling tool for reconnaissance, lateral movement, and credential theft.
Key points
- The campaign exploited CVE-2026-88771 and CVE-2026-88772, critical unauthenticated remote-code-execution flaws affecting NetScaler ADC and Gateway.
- Mandiant said exploitation was ongoing since at least early September and likely affected organizations in North America and Europe across several sectors.
- Attackers gained root access, altered web-server configuration, and planted web shells on compromised appliances.
- Mandiant identified WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python-based tunneling tool used to reach victims’ internal networks.
- The tools enabled reconnaissance, lateral movement, and credential theft; investigators observed manual network exploration and credential theft in at least one intrusion.
- Citrix released patches, and agencies and security firms urged administrators to disconnect affected appliances before patches were available.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-88771 and CVE-2026-88772 for unauthenticated remote code execution against internet-facing NetScaler ADC and NetScaler Gateway appliances.
- After gaining root access, attackers modified appliance web-server configuration to deploy web shells, including the PHP web shell WHIPSHOT.
- In at least one intrusion, attackers used the Python-based tunneling tool SLAPSHOT to explore the victim’s internal network and steal credentials.
- Defensive Notes
- Before patches were released, government cybersecurity agencies and security firms urged administrators to disconnect affected NetScaler appliances from the internet.
- Citrix patched the vulnerabilities; administrators should apply the available patches.
MITRE ATT&CK
T1018 · Remote System DiscoveryAttackers used the tunnel to manually explore the victim’s internal network.T1021 · Remote ServicesThe SLAPSHOT tunnel provided a path from a compromised appliance into the victim’s internal network, enabling lateral movement.T1505.003 · Web ShellAttackers planted web shells on compromised NetScaler appliances and ran them with root privileges.T1552 · Unsecured CredentialsMandiant reported that the attackers used the tools for credential theft; in at least one intrusion, credentials were stolen during internal network exploration.
CVE
People
Malware
SLAPSHOTMandiant found previously unseen malware in the attacks, including a PHP web shell named WHIPSHOT and a Python-based tunneling tool named SLAPSHOT.WHIPSHOTMandiant found previously unseen malware in the attacks, including a PHP web shell named WHIPSHOT and a Python-based tunneling tool named SLAPSHOT.
Vendors
Products
Industries
EducationThese organizations are in the government, financial services, education, legal, and professional services sectors.Financial ServicesThese organizations are in the government, financial services, education, legal, and professional services sectors.GovernmentBefore Citrix released patches, government cybersecurity agencies and security firms took the rare step of urging administrators to disconnect affected NetScaler appliances from the internet immediately while zero-dayLegalThese organizations are in the government, financial services, education, legal, and professional services sectors.Professional ServicesThese organizations are in the government, financial services, education, legal, and professional services sectors.