NetScaler zero-days: WHIPSHOT and SLAPSHOT malware, IoCs to hunt

📌 Later developments: NetScaler CVE-2026-107406: SAML IdP at risk even after patching (October 9, 2026)

The two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway fixed on 27 September, CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5), were exploited before the patch: we covered them in our article on the intrusions. In the following days, details of the attacks emerged. Google Threat Intelligence Group (GTIG) and Mandiant described two previously unseen malware families, WHIPSHOT and SLAPSHOT, and the sectors hit; Rapid7 published concrete indicators of compromise. What follows are the technical findings that help you look for signs of intrusion.

Who was hit

According to the GTIG and Mandiant advisory, reported by The Register, the campaign has been running since at least early September and has likely affected organisations in North America and Europe in the government, financial services, education, legal and professional services sectors. Insicurezza Digitale also adds the technology sector.

The sources disagree on when exploitation began: GTIG says the campaign dates back to early September; Insicurezza Digitale reports that watchTowr detected attacks from 20 September; GreyNoise, quoted by The Register, observed an attempt to exploit CVE-2026-88771 against a NetScaler Gateway on 24 September. They all agree on one point: the attacks started before Citrix’s disclosure on Sunday 27 September. There is no public attribution; watchTowr notes that NetScaler has historically been targeted by both state-sponsored groups and ransomware operators.

WHIPSHOT and SLAPSHOT

After exploitation, the attackers deploy custom-built tools to keep persistent root access and use the appliance as a bridge into the internal network:

• WHIPSHOT is a PHP web shell disguised as a Debian package. It hides Base64-encoded command-and-control payloads inside ordinary HTTP headers and acts as an HTTP transport bridge for SLAPSHOT.
• SLAPSHOT is a TCP tunnelling tool written in Python. It takes commands from WHIPSHOT and forwards arbitrary TCP streams to internal hosts. The documented commands are open (opens a TCP connection to a host and port), push (writes data to a session), pull (reads data from a session), exch (exchanges command-and-control data), close (terminates a session) and ping (health check).

In at least one intrusion, GTIG and Mandiant report, the attacker routed traffic through this proxy to carry out internal reconnaissance and credential theft by hand.

Public indicators

According to Insicurezza Digitale, Rapid7 documented an exploit for CVE-2026-88771 based on command injection using the $IFS separator. The observed command packs the whole /flash/nsconfig folder into an archive inside the public /vpn/ web folder, from which it can be downloaded without authentication:

tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig

The folder contains ns.conf with encrypted passwords, SSL certificates, private keys and LDAP, RADIUS and TACACS credentials. Other indicators:

• web shell: /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, SHA256 ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1;
• CVE-2026-88779, the SAML flaw covered in our dedicated article: authentication usernames crafted with shell commands, a payload downloaded from 213.209.159.55, saved to the /v path and executed. An early warning sign is repeated crashing of the nsaaad process until it exceeds the restart limits of the Pitboss supervisor: hence the name “PitScaler” that researcher Kevin Beaumont gave the affair. Citrix rates the impact as denial of service; Beaumont and watchTowr point to code execution capabilities.

In MITRE ATT&CK terms, the behaviour described maps to T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1036 (Masquerading) for the fake Debian package, T1132.001 (Standard Encoding) for the Base64 in headers, and T1090.001 (Internal Proxy) and T1572 (Protocol Tunneling) for SLAPSHOT.

The bigger picture

Iceland’s CERT-IS urges operators to update immediately and check for signs of intrusion; on 7 October the Centre for Cybersecurity Belgium (CCB) called for NetScaler ADC, Gateway and FIPS to be patched for a critical HTTP request/response smuggling vulnerability. According to Insicurezza Digitale, Australia’s ACSC has also confirmed affected organisations. Dark Reading and The Register criticise Citrix’s timing: the vendor did not comment on the attacks before releasing the fixes.

Impact for European and Italian companies

Europe is among the regions hit, and the sectors named, starting with public administration and finance, largely fall within the scope of NIS2. The theft of /flash/nsconfig goes beyond the appliance itself: private keys and directory service credentials remain useful to the attacker even after the update, until they are replaced.

For NIS2 entities, a compromised remote access gateway is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN; banks and financial firms must also consider the incident reporting obligations of the DORA regulation. In healthcare, the gateway often provides remote access to clinical systems.

What to do now

1. Check first, then update: Mandiant’s Charles Carmakal recommends looking for signs of compromise before patching, because the patch alone may not remove the attacker. If you find web shells or suspicious files, preserve the evidence and establish the scope of the intrusion.
2. Hunt for the indicators: the .ctxs.receiver file and its hash, unexpected archives in /var/netscaler/gui/vpn/, unknown PHP files in the web folders, the /v file, connections to 213.209.159.55, repeated nsaaad crashes. Also run Citrix’s indicator of compromise tool in NetScaler Console and watchTowr’s detection artifact generator.
3. Check internal traffic: SLAPSHOT opens TCP connections from the appliance to internal hosts. Look in your internal firewall logs for unusual connections originating from the NetScaler.
4. If you find traces of nsconfig theft: treat every secret in the configuration as exposed. Replace certificates and private keys, change the passwords of the LDAP, RADIUS and TACACS accounts and the administrative ones, and invalidate active sessions.
5. Update: according to Insicurezza Digitale, builds 14.1-73.41 and 13.1-64.28 of 3 October fix all three CVEs (14.1-73.41 FIPS and 13.1-37.282 for FIPS and NDcPP). If you use SAML, also check the later bulletins described in the article on the SAML zero-day.
6. Reduce the attack surface: if you do not need it, consider disabling DTLS on VPN virtual servers, a precondition for CVE-2026-88772. Until you can update, apply the NetScaler Global Deny List signatures.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you quickly find the NetScaler appliances to check. ARX Sentry collects firewall and network device logs in a central collector, so anomalous connections from the perimeter into the internal network stay in front of the analysts. With ARX Horizon you can search for indicators of compromise and look up vulnerabilities from the portal.

Last updated: 9 October 2026