AI-assisted intruders target Japanese firms and steal credentials
TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.
68
Product
Citrix NetScaler
- Mentions · 7d1
- Mentions · 30d5
- All mentions9
- First seenAug 14, 2026
- Last mentioned2d ago
Timeline
9 articles · newest firstProlific Chinese espionage group exploits BeyondTrust zero-day
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
84
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
84
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.
75
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
72
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
72
You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
watchTowr Labs details a pre-authentication remote code execution flaw, tracked as CVE-2026-8452, in Citrix NetScaler appliances.
62
Related CVEs
by mentions- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-84521%8.8Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2021-2375883%9.8Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
- CVE-2015-32469%7.4Race Condition in Red Hat libuser Allows Local Privilege Escalation
- Local Privilege Escalation via Symlink Attack in Red Hat ABRT
Appears with
- Citrixvendor · 9
- Google Threat Intelligence Grouporganization · 5
- Mandiantorganization · 5
- Ivantivendor · 4
- BeyondTrust Remote Supportproduct · 4
- UNC5221threat actor · 4
- Armory Castlethreat actor · 4
- BeyondTrustvendor · 4
- Ivanti Connect Secureproduct · 3
- Ciscovendor · 3
- Warp Pandathreat actor · 3
- Googlevendor · 2
- Bareclawmalware · 2
- CISAorganization · 2
- Sawflymalware · 2
- watchTowr Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.