Citrix NetScaler Zero-Days Exploited to Deploy Web Shells and Tunneling Malware
Summary
Mandiant and GreyNoise report exploitation of two Citrix NetScaler zero-days to gain root access, steal credentials, and tunnel into internal networks using web shells and WHIPSHOT and SLAPSHOT malware. Citrix has released security updates.
Key points
- Citrix confirmed in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments.
- GreyNoise observed an exploit attempt on September 24, before Citrix publicly disclosed the flaws.
- Attackers used PHP web shells and altered web-server configuration to disguise shell access as requests for files such as CSS, images, or packages.
- Mandiant identified WHIPSHOT, a PHP web shell and proxy, and SLAPSHOT, a Python-based TCP tunneling tool used to reach internal hosts.
- Mandiant says attackers modified /bin/sh permissions to maintain root-level execution and used the access for reconnaissance and credential theft.
- Citrix has released security updates for both flaws; Mandiant says updates are the only way to address both vulnerabilities.
- Mandiant recommends checking for unauthorized PHP handlers, suspicious files and processes, unexpected NSPPE crashes, and modified /bin/sh permissions. Disabling DTLS and blocking inbound UDP/443 may mitigate CVE-2026-88772 only.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-88771 and CVE-2026-88772, unpatched NetScaler zero-days, to obtain remote code execution.
- Attackers installed PHP web shells on compromised NetScaler appliances and altered web server configuration to execute them through requests for non-executable file types.
- WHIPSHOT proxied traffic to SLAPSHOT, which tunneled TCP connections from compromised NetScaler appliances to internal devices.
- Attackers modified /bin/sh permissions to retain root-level execution and used the malware proxy to conduct reconnaissance and steal credentials.
- Defensive Notes
- Install the latest NetScaler security updates to address both vulnerabilities.
- Where patching is not immediately possible, Mandiant recommends disabling DTLS where operationally feasible and blocking inbound UDP/443 upstream when DTLS is not required; these mitigations apply only to CVE-2026-88772.
- Inspect appliances for unauthorized PHP handlers or aliases in httpd.conf, suspicious .deb or .sig files containing PHP code, unusual HTTP 404 responses, unexpected NSPPE crashes, and /tmp/.uxdport or /tmp/.uxdlock files.
- Check whether /bin/sh has unexpected setuid root permissions and look for suspicious Python processes launched with nohup or containing Base64-encoded payloads.
- Hunt for the reported source IP and the .ctxs.receiver web shell file.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 149[.]104[.]78[.]141 | GreyNoise identified this as the source IP of an attempt to exploit a Citrix NetScaler Gateway. |
MITRE ATT&CK
T1090 · ProxyWHIPSHOT acted as an HTTP proxy for SLAPSHOT, forwarding encoded request data to the tunneling malware.T1190 · Exploit Public-Facing ApplicationAttackers exploited NetScaler zero-days to obtain remote code execution on exposed appliances.T1505.003 · Web ShellAttackers installed PHP web shells on compromised NetScaler appliances.T1548.001 · Setuid and SetgidAttackers changed /bin/sh permissions to set the setuid bit and maintain root-level execution.T1572 · Protocol TunnelingSLAPSHOT used TCP tunneling to bridge compromised NetScaler appliances and internal devices.
CVE
CVE-2026-88771Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks.CVE-2026-88772Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks.
Malware
SLAPSHOTMandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT.WHIPSHOTMandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT.
Vendors
Products
NetScalerAttackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks.NetScaler ADCCVE-2026-88771 is an unauthenticated remote code execution flaw affecting all NetScaler ADC and Gateway deployments, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution orNetScaler GatewayGreyNoise observed a threat actor attempting to exploit a Citrix NetScaler Gateway on September 24, three days before Citrix publicly disclosed CVE-2026-88771 and CVE-2026-88772.
Industries
Educationto have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.Financial Servicesand are believed to have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.Governmentearly September and are believed to have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.Legalimpacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.Professional Servicesin North America and Europe across the government, financial services, education, legal, and professional services sectors.