Citrix NetScaler Zero-Days Exploited for Weeks Against Government, Finance Targets

Citrix NetScaler Zero-Days Exploited Undetected for Weeks in Espionage Campaign

Citrix NetScaler appliances used by government agencies, banks, and other organizations across North America and Europe were exploited for at least three weeks before defenders caught on, according to research from Google Mandiant and its Google Threat Intelligence Group (GTIG) reported by CyberScoop, alongside corroborating findings from WatchTowr, GreyNoise, and Palo Alto Networks' Unit 42 reported by SecurityWeek. The campaign exploited two zero-day vulnerabilities — CVE-2026-88771, a pre-authentication command injection flaw, and CVE-2026-88772, a pre-authentication memory overflow in NetScaler's DTLS handling — to plant web shells and tunneling malware with root-level access on internet-facing appliances. Mandiant said the earliest confirmed exploitation dates to September 3, and attributed the intrusions to "advanced and suspected state-sponsored threat actors" running what it characterizes as an espionage operation against government, financial services, education, telecom, legal, and professional services organizations. Mandiant CTO Charles Carmakal warned that broader, more opportunistic exploitation by additional threat actors is likely now that the vulnerabilities are public. Citrix disclosed both flaws in a security advisory published on Sunday, September 28, alongside patches for six other vulnerabilities.

How the Campaign Worked

Two Pre-Auth Zero-Days, Chained for Root Access

CVE-2026-88772, a pre-authentication memory overflow in NetScaler's DTLS handling, appears to have been the entry point attackers relied on earliest, with Mandiant tracing exploitation back to September 3. CVE-2026-88771, a pre-authentication command injection flaw, was confirmed in active use by September 24, per GreyNoise's exploitation telemetry. Because both bugs are pre-authentication, attackers needed no valid credentials to reach vulnerable, internet-facing NetScaler appliances — a design factor that made the flaws especially dangerous against edge infrastructure that typically sits outside conventional endpoint detection coverage.

Web Shells and Tunneling Malware With Root Privileges

Once inside, attackers modified web server configurations on compromised appliances to deploy web shells running with root privileges. SecurityWeek's reporting on the malware identifies two specific tools: WHIPSHOT, a PHP-based web shell, and SLAPSHOT, a Python tunneling utility used to pivot traffic into victim networks. Mandiant separately described "novel tunneler malware" and additional custom tooling used for internal reconnaissance and credential theft. Observed tradecraft included manipulating setuid/setgid permission bits on /bin/sh to preserve elevated access, and using web shell command-and-control channels disguised inside HTTP cookie values — techniques designed to blend into legitimate NetScaler traffic and evade casual log review.

Three Weeks of Silent Access Before Detection

The detail CyberScoop emphasizes from Mandiant's findings is the exploitation timeline: attackers had working access to victim NetScaler appliances for a minimum of three weeks — from the September 3 initial compromise until confirmation efforts began in earnest closer to public disclosure in late September — without triggering defender response. Mandiant cautioned that this window "could be even wider" pending further investigation, and noted that NetScaler and similar edge appliances are structurally hard to monitor because they generally don't support the kind of endpoint detection and response (EDR) tooling organizations rely on for servers and workstations.

Sector Targeting and Scale

SecurityWeek's reporting, drawing on the same underlying Mandiant research plus independent confirmation from WatchTowr and GreyNoise, frames the campaign specifically around its target list: government and financial services organizations were named as primary targets, alongside education, telecom, legal, and professional services entities. Unit 42's scanning found roughly 50,000 NetScaler instances potentially exposed to one or both vulnerabilities as of September 27 — a figure that illustrates the scale of the at-risk population even though Mandiant's confirmed victim count ("dozens" of organizations) is far smaller.

Impact Assessment

Recommendations

For NetScaler Administrators

• Apply Citrix's September 28 security advisory patches for CVE-2026-88771, CVE-2026-88772, and the six accompanying CVEs immediately — treat any unpatched, internet-facing NetScaler appliance as compromised until proven otherwise.
• Hunt for indicators of the WHIPSHOT web shell and SLAPSHOT tunneling tool, including unexpected web server configuration changes, modified setuid/setgid bits on /bin/sh, and anomalous cookie values in HTTP request logs.
• Review NetScaler appliance logs back to at least September 3 given the confirmed three-week-plus dwell time; do not assume a clean scan today rules out earlier compromise.

For Security Operations Teams

• Treat edge appliances (VPN gateways, load balancers, application delivery controllers) as high-value targets that require dedicated monitoring — traditional EDR does not cover them, which is precisely what let this campaign persist undetected for weeks.
• Correlate outbound connections from NetScaler appliances against known SLAPSHOT tunneling infrastructure and unusual internal reconnaissance patterns following any suspected compromise.
• Assume credential theft occurred on any appliance with confirmed exploitation, and rotate credentials and certificates that traversed the compromised device.

For Government and Financial Sector Organizations

• Given explicit targeting of government and financial services verticals, prioritize NetScaler asset inventory and patch verification over the standard patch-cycle timeline.
• Engage incident response support proactively if any appliance shows signs of the reported tradecraft — Mandiant's espionage attribution suggests attackers may already have achieved deeper network persistence.
• Expect a second wave: Mandiant's own warning of impending "broad and opportunistic exploitation" means unpatched appliances remain at risk even after the initial espionage-focused campaign is contained.

Key Takeaways

1. Google Mandiant/GTIG confirmed suspected state-sponsored actors exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for at least three weeks — starting September 3 — before detection.
2. Dozens of organizations in government, financial services, education, telecom, legal, and professional services across North America and Europe were confirmed impacted, per Mandiant's investigation reported by CyberScoop.
3. Palo Alto Networks Unit 42 estimated roughly 50,000 NetScaler instances were potentially exposed as of September 27, a scale figure reported by SecurityWeek alongside corroborating research from WatchTowr and GreyNoise.
4. Attackers deployed root-privileged web shells (WHIPSHOT) and tunneling malware (SLAPSHOT) to conduct internal reconnaissance, credential theft, and lateral movement after initial compromise.
5. Citrix disclosed both vulnerabilities and released patches on Sunday, September 28, bundled with fixes for six additional vulnerabilities.
6. Mandiant's CTO Charles Carmakal expects broader, opportunistic exploitation by additional threat actors now that the flaws are public — making immediate patching and compromise assessment critical even for organizations outside the initially targeted sectors.

Sources

• SecurityWeek: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
• CyberScoop: Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected