In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. A second zero-day, CVE-2026-88771, is also being exploited per vendor disclosures. The observed campaign has targeted organizations in North America and Europe across government, financial services, education, legal, and professional services sectors, with activity ongoing since at least early September. Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine (NSPPE) to achieve initial root-level access on the underlying FreeBSD platform. Telemetry suggests that specially malformed or fragmented DTLS record headers cause heap memory corruption during the pre-authentication cryptographic handshake, diverting control flow to execute arbitrary shellcode with root privileges. Successful exploitation generates two log artifacts: an SSL_HANDSHAKE_FAILURE event with DTLSv1.0 and reason ‘Handshake failure-Internal Error’, and an NSPPE process termination recorded by the FreeBSD kernel and the pitboss watchdog daemon.

The threat actor establishes persistence by modifying /etc/httpd.conf to treat non-script file extensions as executable PHP. Two methods were observed: masquerading .deb files as PHP via AddHandler, and a stealthier approach using AliasMatch to map requests ending in .ico to corresponding .sig files in /var/netscaler/gui/vpn/scripts/linux/, effectively disguising web shell execution as image requests. To maintain root-level execution for web shells, the actor sets the setuid bit on /bin/sh (chmod u+s /bin/sh) and either triggers a full appliance reboot via /netscaler/nsshutdown -R or restarts the web service directly with /bin/httpd -k restart -f /etc/httpd.conf. Some web shell variants also scrub their installation path from /etc/crontab to evade detection.

The post-exploitation toolkit includes multiple PHP web shells and a Python tunneler. Installer and standalone shells (e.g., nsginstaller.deb, nsgclient.sig) receive Base64-encoded commands via HTTP headers such as HTTP_NSC_LDAP or HTTP_NSC_CLIENTTYPE, execute them via shell_exec() or eval(), and return Base64-encoded output. Some variants simulate HTTP 404 responses to blend in with benign traffic. WHIPSHOT is a more advanced PHP web shell disguised as a Debian package that functions as an HTTP transport bridge for the SLAPSHOT proxy daemon. It reads sequential HTTP_X_UX_0 through HTTP_X_UX_95 headers, Base64-decodes them, and forwards the data over loopback to SLAPSHOT. It also manages SLAPSHOT‘s lifecycle by checking for /tmp/.uxdport and /tmp/.uxdlock and spawning the proxy via nohup if not running. SLAPSHOT is a Python TCP tunneling tool that binds to an ephemeral loopback port, writes the port to /tmp/.uxdport, locks /tmp/.uxdlock, and uses a custom binary protocol with 4-byte big-endian length prefixes and JSON payloads. Supported commands include open, push, pull, exch, close, and ping. It idles out sessions after 15 minutes and exits after 10 minutes of inactivity (configurable via UXD_IDLE_EXIT) to reduce its footprint.

The blog provides extensive hunting and containment guidance. Hunting strategies include inspecting /etc/httpd.conf for unauthorized AddHandler, php_flag, or AliasMatch directives; auditing script directories for PHP files masquerading under non-script extensions; reviewing web server access and error logs for anomalous 404 responses or large payloads; checking for SLAPSHOT artifacts like .uxdport and .uxdlock; verifying /bin/sh permissions for SUID; and examining process listings and shell history for suspicious python or nohup commands. Containment options are phased: apply the latest Citrix build (NetScaler 14.1-73.37 or 13.1-64.23 and later), isolate compromised appliances, or implement compensating controls. For delayed patching, the blog recommends disabling DTLS and blocking inbound UDP/443 upstream, since the exploit is delivered over UDP/443 using DTLS. Credential rotation and session revocation are also advised, along with rotating appliance secrets, LDAP bind accounts, RADIUS shared secrets, and TLS certificates. Logging and detection engineering guidance covers ensuring SIEM receives NetScaler ns.log, FreeBSD /var/log/messages, web server logs, and firewall flow logs, then correlating DTLS handshake failures with NSPPE terminations, monitoring for pitboss ‘NOT restarting’ messages, and detecting unauthorized httpd.conf changes or SUID /bin/sh.

The campaign underscores that edge devices—ADCs, VPN gateways, firewalls—remain prime targets because they are internet-exposed, outside EDR coverage, and often hold credentials. Notably, such vulnerabilities accounted for about half of enterprise-related zero-days in 2025. The post includes specific IOCs (e.g., IPs 143.198.7.94 and 157.254.167.12, command headers, and file paths) and YARA rules for detecting WHIPSHOT, SLAPSHOT, unauthorized Apache config changes, NetScaler C2 headers, and persistence scripts. Google Security Operations is adding detection rules to the Mandiant Intel Emerging Threats pack.