[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHZziKPWFBfY0B4qk_aYXHO_tySAmYuli68Drx7Imnzg":3},{"article":4,"iocs":45,"watch_terms":81,"solutions":82,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"77278ac4-b25f-47e1-8106-0bae2280965d","Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs","citrix-netscaler-post-exploitation-payload-creates-superuser-maps-web-shell-to-c-875745","Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler","Threat actors are actively exploiting a critical command injection vulnerability (CVE-2026-88771) in Citrix NetScaler ADC and Gateway. The exploitation allows for the deployment of web shells, creation of superuser accounts, and theft of configuration data, with attackers attempting to mask malicious activity by mapping web shells to CSS-like URLs.","Citrix NetScaler exploited via CVE-2026-88771 for post-exploitation, web shells, and data theft.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcitrix-netscaler-post-exploitation.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjAuODp7WTARNyJa6hiyuveQ1LUgYlaYQXGDDfRAYUA7Zkwwb7vMriA7VIh5HmBJwWWR0kALhQkijvT43ke2ajjOQHk6YxQb2rAgsB0PYcbMKPdm-JezjILBH8j3kY29iATKhZLQhVIyAjwNj9XFBTeenqPCHM1AzKMKRCVlMME3jQs5yIYSoVtrbRnVSY7\u002Fs1600\u002Fcitrix-css-shell.jpg","2026-10-01T04:35:34+00:00","2026-10-01T06:00:05.399592+00:00",9,[17,20,22,25],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":24},"LevelBlue","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,57,61,64,67,69,72,75,78],{"type":47,"value":48,"context":49},"cve","CVE-2026-88771","Critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway.",{"type":47,"value":51,"context":52},"CVE-2026-88772","Related vulnerability exploited for web shells and Python tunneler.",{"type":54,"value":55,"context":56},"ip","64.94.85.67","IP address used for payload retrieval and configuration data upload.",{"type":58,"value":59,"context":60},"url","http:\u002F\u002F64.94.85.67:443\u002Fupdate_c08937.pl","URL for a Perl script payload.",{"type":54,"value":62,"context":63},"31.56.197.72","IP address observed in exploitation attempts.",{"type":58,"value":65,"context":66},"http:\u002F\u002F31.56.197.72:9090\u002Flula","URL observed in exploitation attempts.",{"type":54,"value":68,"context":63},"23.27.143.20",{"type":58,"value":70,"context":71},"http:\u002F\u002F23.27.143.20:9000\u002Fmain.py","URL for a Python script payload.",{"type":54,"value":73,"context":74},"45.141.21.130","IP address for reverse shell connection.",{"type":39,"value":76,"context":77},"WHIPSHOT","PHP web shell delivered via CVE-2026-88772 exploitation.",{"type":39,"value":79,"context":80},"SLAPSHOT","Python tunneler delivered via CVE-2026-88772 exploitation.",[23,26,18],{"controls":83,"vendors":168},[84,113,142],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":143,"name":144,"problem":145,"products":146},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[147,155,160],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":156,"product_name":157,"url":158,"description":159},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":161,"vendor_name":162,"vendor_logo":163,"product_slug":164,"product_name":165,"url":166,"description":167},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[169],{"slug":170,"name":23,"logo_path":171,"roles":172},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[173],"affected",{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":194},"citrix-netscaler-exploited-web-shells-hidden-in-css-like-urls-superusers-created","Citrix NetScaler Exploited: Web Shells Hidden in CSS-Like URLs, Superusers Created","Threat actors are actively exploiting CVE-2026-88771, a critical command injection vulnerability in Citrix NetScaler ADC and Gateway, to deploy web shells, create unauthorized superuser accounts, and exfiltrate configuration data. Attackers are deliberately obfuscating malicious web shells by mapping them to CSS-like URLs, making detection significantly harder for defenders relying on simple pattern matching. This attack chain demonstrates how unpatched network edge appliances become high-value footholds — granting attackers privileged access and persistence deep within an environment. The combination of superuser creation and configuration data theft means that even after remediation, stolen credentials and secrets may enable secondary intrusions, making rapid response and secret rotation critical.",[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-2: Account Management","NIST AU-6: Audit Record Review, Analysis, and Reporting","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","ITIL: Change Enablement (Emergency Change Process)","ITIL: Problem Management (Vulnerability Root Cause Analysis)","MITRE ATT&CK T1505.003: Server Software Component – Web Shell","MITRE ATT&CK T1136: Create Account","MITRE ATT&CK T1562.006: Impair Defenses – Indicator Blocking",{}]