Custom Malware Exploits Citrix Zero-Day in Government and Financial Sectors
Critical vulnerabilities in Citrix NetScaler targeted by advanced attackers using novel malware.
1Widespread exploitation before disclosure
Attackers exploited two critical Citrix vulnerabilities (CVE-2026-88771 and CVE-2026-88772) as zero-days for weeks before public disclosure. The flaws, scoring 9.5 CVSS, allowed remote code execution on NetScaler ADC and Gateway appliances. Targets included government agencies, banks, and professional services across North America and Europe. Security researchers observed exploitation attempts as early as September 24, with active campaigns dating to early September.
2Citrix's delayed response criticized
Citrix took weeks to disclose vulnerabilities discovered during incident response at already-compromised organizations. The vendor has a history of delaying vulnerability publications even during active exploitation. Security experts question why Citrix waited so long, as the company declined to comment. The delayed response allowed attackers to maintain access to compromised systems across multiple sectors before patches became available.
3Custom malware toolkit revealed
Attackers deployed never-before-seen malware including WHIPSHOT (PHP web shell) and SLAPSHOT (Python TCP tunneling tool). WHIPSHOT masquerades as a Debian package and uses HTTP headers for C2 communications. SLAPSHOT establishes persistent proxy connections to internal networks, supporting commands for session management, data transfer, and health checks. The tools enabled manual reconnaissance and credential theft within victim environments.
4Edge devices remain prime targets
The attack highlights attackers' preference for edge devices like VPN gateways and ADCs, which provide direct internet access to corporate networks. Google reports edge device vulnerabilities accounted for half of enterprise zero-days in 2025. NetScaler's history includes multiple critical vulnerabilities, with another exploited in March 2026 and previous zero-days in 2025. These devices often bypass endpoint security controls when compromised.
5Complex remediation required
Mandiant warns patching alone may not remove attackers, advising organizations to check for web shells and malicious files before updating. Evidence preservation is critical for understanding compromise scope. WatchTowr released detection tools to help identify vulnerable systems. The custom malware's persistence mechanisms mean some organizations may remain compromised despite applying Citrix's security updates.
6Attribution remains unclear
No group has been publicly attributed to the campaign, with no clear targeting pattern by industry or organization size. Historically, NetScaler vulnerabilities have been exploited by both state-sponsored actors and ransomware groups. The sophisticated custom malware suggests advanced capabilities, but Google hasn't disclosed observed attack volumes or success rates. The campaign underscores evolving threats to network perimeter devices.
7Vulnerability disclosure challenges
The incident raises questions about vulnerability disclosure timelines when exploits are already active. Citrix became aware through forensic investigations at compromised organizations, yet delayed public warning. This gap allowed widespread exploitation before mitigation. The case highlights tensions between vendors' patch development cycles and attackers' exploitation windows, particularly for widely deployed enterprise networking equipment.
8Sector-wide security implications
The attacks demonstrate how single vulnerabilities in common enterprise infrastructure can enable cross-sector compromises. Government, finance, education, and professional services were all impacted through Citrix appliances. The campaign's duration and geographic spread suggest careful target selection. Security teams must now assume edge devices are primary attack vectors requiring enhanced monitoring beyond standard patch management.