ゼロデイ脆弱性を突いてCitrix NetScalerに侵入することは、高度な攻撃の第一段階にすぎません。侵入に成功した攻撃者は、これまで確認されていなかったインプラント「WHIPSHOT」と「SLAPSHOT」を展開します。これらの悪質なツールはデバイスへの永続的なアクセスを確保し、境界ゲートウ

Breaching a Citrix NetScaler via a zero-day vulnerability merely constitutes the inaugural phase of a sophisticated attack. Following successful infiltration, threat actors deploy previously uncatalogued implants, WHIPSHOT and SLAPSHOT. These insidious tools guarantee persistent device access, effectively transforming the perimeter gateway into a clandestine bridgehead leading directly into the corporate internal network. The Google Threat Intelligence Group, in collaboration with Mandiant, primarily attributed this observed campaign to CVE-2026-88772.

Since at least early September 2026, attackers have taken root-level control of Citrix NetScaler appliances without a password. Mandiant and Google Threat Intelligence Group (GTIG) traced the break-ins to a Citrix NetScaler zero-day, CVE-2026-88772. In their new report on the campaign, the researchers describe custom web shells hidden behind fake image requests. At a Glance Actor

within native HTTP headers read more about Attackers Exploit NetScaler Flaw for Root Access Deploy WHIPSHOT and SLAPSHOT

Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe. The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional

Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been […]

Two critical Citrix NetScaler vulnerabilities were exploited as zero-days starting September 1, 2026, three weeks before Citrix published its security bulletin on September 27. Google Threat Intelligence Group and Mandiant confirm a targeted campaign against government, financial, educational, legal

YouTube video by The Daily Hot Drop

{{rh9e7yNRO}}

Haz clic para acceder al contenido completo.

Citrix NetScaler root shells exploit (CVE-2026-88772) deploys Whipshot/Slapshot malware. FBI warns ShinyHunters. Apple CoreGraphics 0-day. Patch now.

Unknown actors exploited a critical Citrix NetScaler zero-day in September 2026, deploying WHIPSHOT and SLAPSHOT web shells to gain root access across multiple sectors.

Unknown attackers exploit a patched Citrix NetScaler flaw to gain root access and deploy web shells and a tunneler.

不明な攻撃者が既知の Citrix NetScaler 脆弱性を悪用してroot権限を獲得。Webシェルとトンネリングツール WHIPSHOT、SLAPSHOT を配置される。管理者は対策済みシステムも含め緊急検査が必要。

Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe. The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional

Researchers detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.

Mandiant reveals how attackers exploited Citrix NetScaler CVE-2026-88772 for root access, deployed WHIPSHOT web shells and SLAPSHOT tunneling malware, and pivoted into internal networks.

Mandiant and GTIG identified active exploitation of CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway, with intrusions using custom tooling to gain root access, persist, and move into internal networks. The campaign deployed WHIPSHOT and SLAPSHOT to hide C2 in HTTP headers, proxy traffic for reconnaissance and credential theft, and abuse modified web server settings, while Citrix also warned that CVE-2026-88771 is being actively exploited. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #WHIPSHOT #SLAPSHOT

Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks. Mandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT. #Citrix #NetScaler #CVE-2026-88771 #CVE-2026-88772 #Mandiant #GreyNoise #WHIPSHOT #SLAPSHOT