Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.

Citrix disclosed eight CVEs including critical CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5) in NetScaler ADC and NetScaler Gateway, both exploited as zero-days before public disclosure. Google Threat Intelligence and Mandiant say the campaign, ongoing since at least early September, hit government, financial services, education, and legal/professional services organizations across North America and Europe. Post-exploitation tooling includes WHIPSHOT, a PHP web shell disguised as a Debian package hiding base64-encoded C2 in HTTP headers, and SLAPSHOT, a Python TCP tunneling tool that proxies traffic into internal networks. No attribution has been made; Mandiant urges customers to hunt for compromise before patching.