[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fL1JllIeMJLERbwieeYJKA7hmNdeEDybRG3nTL_c7jQs":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3dfa882f-287f-43ad-8b89-cd494f3c26ea","Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected","attackers-exploited-citrix-netscaler-zero-day-for-at-least-three-weeks-undetecte-48d745","Mandiant researchers said dozens of organizations have been impacted by attacks attributed to advanced and suspected state-sponsored threat groups. They expect more attacks to come. The post Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected appeared first on CyberScoop.","Mandiant researchers revealed that advanced, suspected state-sponsored threat actors exploited two critical zero-day vulnerabilities in Citrix NetScaler appliances for at least three weeks undetected. The earliest exploitation of CVE-2026-88772 was noted on September 3rd, with CVE-2026-88771 also being exploited since at least September 24th. Dozens of organizations across various sectors in North America and Europe were impacted, with attackers using novel tools and tactics, including tunneler malware, for reconnaissance and data theft.","Attackers exploited two Citrix NetScaler zero-days for weeks before detection.","https:\u002F\u002Fcyberscoop.com\u002Fcitrix-netscaler-zero-day-attacks-three-weeks-undetected\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2190684145.jpg","2026-09-29T21:30:22+00:00","2026-09-29T22:00:28.778092+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Citrix NetScaler","product",{"name":21,"type":22},"Citrix","vendor",{"name":24,"type":25},"advanced and suspected state-sponsored threat actors","threat_actor",{"name":27,"type":22},"Mandiant",{"name":29,"type":22},"GreyNoise",{"name":31,"type":22},"watchTowr","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":32,"icon":34,"name":35,"slug":36},null,"Zero-day","zero-day",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-88772","Citrix NetScaler zero-day vulnerability exploited by attackers.",{"type":57,"value":61,"context":62},"CVE-2026-88771","Second Citrix NetScaler zero-day vulnerability exploited by attackers.",[21,27,29],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":96,"name":97,"problem":98,"products":99},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":125,"name":126,"problem":127,"products":128},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[154,159],{"slug":155,"name":21,"logo_path":156,"roles":157},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[158],"affected",{"slug":160,"name":161,"logo_path":162,"roles":163},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":183},"citrix-netscaler-zero-days-exploited-undetected-for-weeks","Citrix NetScaler Zero-Days Exploited Undetected for Weeks","Suspected state-sponsored attackers exploited two critical zero-day vulnerabilities in Citrix NetScaler appliances for over three weeks before discovery, targeting dozens of organizations across North America and Europe. The extended dwell time highlights a critical failure in detection and monitoring capabilities for internet-facing network appliances. Attackers leveraged novel tunneler malware for reconnaissance and data theft, demonstrating the sophistication of threats targeting perimeter infrastructure. Zero-day exploitation is particularly dangerous because no patch exists at the time of attack, making robust behavioral monitoring and anomaly detection the last line of defense. This incident underscores that organizations must not rely solely on patch-based defenses for critical edge devices.",[170,171,172,173,174,175,176,177,178,179,180,181,182],"CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61 Rev. 2: Incident Response","NIST SI-4: System Monitoring","NIST RA-5: Vulnerability Monitoring and Scanning","NIST CM-7: Least Functionality","NIST IR-4: Incident Handling","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1572: Protocol Tunneling","GDPR Article 32: Security of Processing (breach detection obligation)","ITIL: Problem Management (zero-day risk reduction)",{}]