Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

1. Executive summary

Two critical NetScaler vulnerabilities, CVE-2026-88771 (CVSS 9.5, CWE-20) and CVE-2026-88772 (CVSS 9.5, CWE-119), were exploited as zero-days against Citrix NetScaler ADC and NetScaler Gateway appliances before Citrix disclosed them on 27 September 2026. Both are in CISA KEV (added 2026-09-27) and both carry EPSS 1%. Google Threat Intelligence Group and Mandiant report the campaign has run since at least early September and has likely impacted government, financial services, education, legal and professional services organisations in North America and Europe, with custom post-exploitation malware (WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python TCP tunnelling tool) used to hold persistent root access and proxy traffic into internal networks. For EMEA financial services the exposure is direct: NetScaler ADC and Gateway are common remote-access and application-delivery edge devices, and the attacker toolkit is built to tunnel into internal hosts and steal credentials rather than to sit on the appliance. No attribution has been made public.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed steps, drawn from Citrix, CISA, Google Threat Intelligence Group and Mandiant reporting:

1. The attacker reaches an internet-exposed NetScaler ADC or NetScaler Gateway appliance. CVE-2026-88771 is exploitable in the default configuration with no additional product features enabled, and Citrix rates its attack complexity as low, so reliable remote code execution is expected against any unpatched appliance regardless of configuration.
2. CVE-2026-88771 (CWE-20, improper input validation) allows an unauthenticated attacker to execute arbitrary commands remotely. CVE-2026-88772 (CWE-119, memory overflow) is a second path to remote code execution or denial of service and requires the DTLS feature to be enabled, which it is by default on VPN virtual servers; Citrix rates its attack complexity as high, so reliable exploitation is harder than via CVE-2026-88771.
3. Post-exploitation, the actor deploys WHIPSHOT, a PHP web shell disguised as a Debian package. WHIPSHOT hides Base64-encoded command-and-control payloads in native HTTP headers and acts as an HTTP transport bridge.
4. WHIPSHOT carries commands to SLAPSHOT, a TCP tunnelling tool written in Python. SLAPSHOT accepts commands from WHIPSHOT and forwards arbitrary TCP streams to internal hosts. Its supported commands are: open (establish an outbound TCP socket to a target host and port), push (write data to an open session), pull (poll and read data from an open session socket), exch (send and receive command-and-control data to and from an open session socket), close (terminate a specified network session), and ping (basic health-check verification).
5. In at least one observed intrusion, the actor routed traffic through this proxy to manually conduct internal reconnaissance and credential theft. The toolkit's purpose is persistent root access on the appliance plus a tunnel into the internal corporate network.

The eight CVEs Citrix disclosed on 27 September 2026 are CVE-2026-88771 and CVE-2026-88772 (both critical, both exploited), CVE-2026-88773 (HTTP request smuggling, CVSS 9.3), three 8.8-rated memory overflow bugs, an 8.8-rated TCP initial sequence number prediction bug, and a 7.0-rated policy bypass involving URL-based expressions. Only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited.

Vendor fixes, per Rapid7: NetScaler ADC and NetScaler Gateway 14.1-73.37 and later; 13.1-64.23 and later releases of 13.1; NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS; NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP.

Exploitation has escalated. Help Net Security reports that what began as stealthy targeting via zero-days became widespread "spray and pray" exploitation after publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771. GreyNoise observed an attempt to exploit CVE-2026-88771 against a NetScaler Gateway on 24 September, three days before disclosure.

Confidence caveats. The target-sector assessment (government, financial services, education, legal and professional services across North America and Europe) and the WHIPSHOT and SLAPSHOT detail rest on the Google Threat Intelligence Group and Mandiant advisory; treat the sector list as likely-impacted rather than confirmed victim counts, and note that Google did not answer questions on the number of exploitation attempts or successful intrusions. The claim that a Citrix channel partner knew of the flaws on Saturday and urged users to take NetScalers offline a day before disclosure is an allegation in a Reddit thread, not a confirmed fact. The claim that Citrix delayed publication is attributed to watchTowr's CEO and is an opinion, not a documented finding. No attribution has been made public; watchTowr notes no clear trend among targets by industry or organisation size, and that NetScaler flaws have historically been exploited by both state-sponsored groups and ransomware operators. Nothing in the sources indicates ransomware or data-theft extortion in this campaign, and no MITRE ATT&CK profile is available for the actor, so attribution is unconfirmed.

4. Mitigation & containment

P1, within 24 hours:

• Hunt before you patch. Mandiant Consulting CTO Charles Carmakal's guidance is explicit: examine systems for compromise before upgrading, because patching alone may not eradicate the actor. Preserve evidence of any web shell or other malicious file found, then investigate scope.
• On each NetScaler ADC and Gateway appliance, look for a PHP web shell masquerading as a Debian package and for the SLAPSHOT Python tunnelling tool. Treat any PHP execution on a NetScaler appliance as hostile.
• Inspect HTTP request headers on the appliance and at the reverse proxy in front of it for Base64-encoded blobs in native headers, which is WHIPSHOT's command-and-control channel.
• Review outbound TCP from the appliance management and NSIP addresses to internal hosts. SLAPSHOT's open command creates outbound sockets to arbitrary internal host and port pairs; that traffic pattern should not exist from a NetScaler.
• If compromise is confirmed, isolate the appliance from the internal network before patching, and treat internal credentials used from or visible to the appliance as exposed.
• Apply the vendor fixes on an emergency basis, outside the normal patch cycle: 14.1-73.37 and later, 13.1-64.23 and later releases of 13.1, 14.1-FIPS 14.1-73.37 FIPS and later, and 13.1-FIPS / 13.1-NDcPP 13.1.37.279 and later.

P2, within 72 hours:

• Where patching cannot be completed inside 24 hours, take the appliance out of service or restrict it to known source addresses. Kevin Beaumont's interim guidance was to switch it off if the organisation is sensitive to NetScaler vulnerabilities.
• Use watchTowr's detection artifact generator, published 29 September, to determine whether an appliance is vulnerable and to support remediation.
• Rotate credentials and certificates that were present on or reachable from the appliance, including any stored in the NetScaler configuration.
• Check for the other six CVEs in the same disclosure and confirm the applied build covers all eight.

P3, within 7 days:

• Add the WHIPSHOT and SLAPSHOT behaviours to EDR and network detection, and alert on outbound TCP from NetScaler appliances to internal RFC1918 ranges.
• Review whether NetScaler appliances are internet-exposed where they need not be, and whether compensating controls in front of them would have caught the header-borne command-and-control channel.
• Confirm that the incident classification and reporting workflow under DORA Art. 18 and Art. 19 can be started from a confirmed edge-device compromise, since the pre-disclosure exploitation window is part of the timeline.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The sources describe the malware's behaviour and command set but publish no machine-pivotable values. The table below records the behavioural indicators only.

Behavioural indicators

No copyable indicator block is provided because the sources contain no atomic indicators.

6. Detection

The sources give distinctive command names and behaviours for SLAPSHOT and WHIPSHOT but no file hashes, mutexes, or fixed strings beyond the command set. The YARA rule below keys on the SLAPSHOT command set and the WHIPSHOT characteristics as described; because the sources do not publish literal strings from the binaries, the rule uses the documented command names as they appear in the reporting and should be treated as a starting point to be tuned against a sample.

rule SLAPSHOT_TCP_Tunnel_Python
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-29"
        reference = "https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867"
        description = "Detects SLAPSHOT TCP tunnelling tool command set as documented by Google Threat Intelligence Group and Mandiant"
    strings:
        $c1 = "open"
        $c2 = "push"
        $c3 = "pull"
        $c4 = "exch"
        $c5 = "close"
        $c6 = "ping"
        $py = "python"
    condition:
        5 of ($c*) and $py
}

title: Outbound TCP from NetScaler Appliance to Internal Host
id: 8f2c1a44-7b3e-4d21-9c6a-0e5b2d9f1a77
status: experimental
description: Detects outbound TCP connections originating from a Citrix NetScaler ADC or Gateway appliance to internal RFC1918 hosts, consistent with SLAPSHOT tunnelling documented in the September 2026 Citrix NetScaler exploitation campaign.
author: Adverse Trace
date: 2026-09-29
references:

  - https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867
logsource:
  category: network_connection
  product: firewall
detection:
  selection_src:
    src_ip|cidr:

      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_dst:
    dst_ip|cidr:

      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_src and selection_dst
falsepositives:

  - Legitimate NetScaler health checks or load-balancer probes to internal backends
level: medium

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• The Register, "Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services", https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867, 2026-09-29
• Help Net Security, "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)", https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/, 2026-09-28
• Tenable Research, "Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities", https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities, 2026-09-27
• Rapid7, "Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772", https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772, 2026-09-28
• Help Net Security, "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)", https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771/, 2026-09-29
• The Register, "Certainties in life: Death, taxes, and critical Citrix vulns under attack", https://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369, 2026-09-28
• The Hacker News, "CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally", https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html, 2026-09-28

8. Adverse Trace position

Adverse Trace assesses CVE-2026-88771 and CVE-2026-88772 as critical and actively exploited, consistent with the verified reference data: both CVSS 9.5, both in CISA KEV since 2026-09-27, both EPSS 1%. The EPSS figure is low but does not reduce urgency here, because KEV status and confirmed zero-day exploitation before disclosure are the controlling facts, and exploitation has since escalated to mass scanning after a proof-of-concept was published. The client impact for EMEA financial services is elevated: the target set explicitly includes financial services, the toolkit is built for persistent root access and internal tunnelling rather than opportunistic access, and Mandiant's warning that patching alone may not remove the actor means a patched appliance is not evidence of a clean one. Attribution is unconfirmed; no actor has been named publicly and no MITRE ATT&CK profile is available, so we are not assigning this to a known group. The WHIPSHOT and SLAPSHOT detail and the target-sector assessment are single-sourced to Google Threat Intelligence Group and Mandiant; verify before enforcing detections built on them. We will track the Citrix advisory and watchTowr's detection artifact generator for updated technical detail, and we will issue a follow-up if attribution is made public or if confirmed victim counts in EMEA financial services emerge. Clients running internet-exposed NetScaler ADC or Gateway should treat this as an active incident-response task, not a patch cycle: hunt first, preserve evidence, then patch.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.