Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells

Google has warned that threat actors are actively exploiting two critical Citrix NetScaler zero-day vulnerabilities to gain root access, install stealthy web shells, and move into victim networks.

The activity has affected organizations in North America and Europe, including government, financial services, technology, education, legal, and professional-services sectors.

Mandiant Consulting and Google Threat Intelligence Group (GTIG) said the campaign has been active since at least early September 2026.

The attackers are abusing CVE-2026-88772, a critical memory-overflow flaw in Citrix NetScaler ADC and NetScaler Gateway appliances, alongside CVE-2026-88771, an unauthenticated remote code execution vulnerability caused by improper input validation.

Citrix assigned both flaws a CVSS score of 9.5 and confirmed active exploitation. CVE-2026-88772 affects appliances with Datagram Transport Layer Security enabled, which is enabled by default on VPN virtual servers.

Google said exploitation bypasses authentication and causes an unhandled termination of the NetScaler Packet Processing Engine, or NSPPE.

This lets attackers gain root-level access to the underlying FreeBSD operating system. After compromising an appliance, the attackers modify the httpd.conf web server configuration to make deceptive file types execute as PHP.

Citrix 0-Day Exploited to Deploy Webshells

In observed intrusions, the threat actors configured .deb package files and .sig signature files as executable PHP scripts. They also used icon aliases so a request for an apparently harmless .ico file could trigger a hidden web shell.

The campaign deploys a newly identified PHP web shell called WHIPSHOT. The malware hides Base64-encoded command-and-control data in legitimate-looking HTTP headers, helping attackers blend malicious traffic into normal web requests.

WHIPSHOT can relay commands and results while returning fake HTTP 404 Not Found responses, potentially misleading administrators reviewing web logs.

Researchers also identified a Python tunneling tool named SLAPSHOT. The malware listens on a local loopback port and proxies arbitrary TCP traffic from the compromised NetScaler device into the internal network.

This capability allows attackers to perform reconnaissance, connect to internal hosts, steal credentials, and support lateral movement. In one intrusion, the operators reportedly used the proxy for manual internal reconnaissance and credential theft.

The attackers also attempted to preserve root-level access by setting the setuid permission bit on /bin/sh. This makes the system shell execute with elevated privileges, even when commands originate from a lower-privileged web-server process. In some cases, the attackers rebooted the appliance or restarted Apache to activate the malicious configuration changes.

Security teams should urgently update affected NetScaler systems. Citrix lists fixed releases including NetScaler 14.1-73.37 and later, as well as NetScaler 13.1-64.23 and later; equivalent fixed FIPS builds are also available.

Administrators should inspect /etc/httpd.conf for suspicious AddHandler, AliasMatch, and PHP directives search VPN script directories for PHP code hidden in .deb or .sig files; and check for /tmp/.uxdport or /tmp/.uxdlock, which may indicate SLAPSHOT activity.

A setuid-enabled /bin/sh, unexpected NSPPE crashes, DTLS handshake failures, and unusual requests to /vpn/media/ or /vpn/scripts/ should be treated as high-priority compromise indicators.

GreyNoise observed attempted exploitation before Citrix publicly disclosed the flaws, including activity from 149.104.78.141 on September 24. The finding highlights the continuing risk posed by internet-facing edge appliances, which often lack endpoint detection coverage while providing direct access to sensitive internal environments.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC