{ "schema_version": 2, "updated": "2026-10-05", "sources": [ { "id": "cisa-direct", "url": "https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "title": "CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway", "published": "2026-09-27", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source.", "requested": false }, { "id": "cisa", "url": "https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc465", "title": "CISA bulletin distributed through GovDelivery", "published": "2026-09-27", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Full text reviewed.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "Full text reviewed.", "requested": false }, { "id": "mandiant", "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "title": "Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances", "published": "2026-09-29", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Full text reviewed without the language parameter; the ?hl=en URL variant was unavailable.", "retrieved_utc": "2026-10-01T19:36:45.063963+00:00", "http_status": 200, "final_url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "bytes": 400523, "sha256": "f89b6942e28d8b4de5f563f90f8fe74043e4135ff8415eea984511d3630edcb4", "publication_date": "2026-09-29", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified.", "indicator_ids": [ "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", "ioc-c8992c16-710d-584d-863e-4d154f19beb5", "ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e", "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", "ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7", "ioc-a71cff59-53a9-55a7-8c3e-ae19f9072b18", "ioc-e16b4205-4942-5cb7-a6b4-d218dcd3f2f5", "ioc-e38612e8-8199-5afb-9615-1733293a94d1" ], "rule_ids": [ "9d719506-517e-50fb-9675-48d2907c8733", "f2b2bc2b-d781-56e6-a464-5731efb85c10", "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", "35bc541e-25f4-5d4b-80e4-b22f2e9ff801", "f2336666-9fca-5688-93b7-bf4fa85e082e", "2fe32158-28e3-5512-8640-f713c7f6d2c0", "3aa3db2c-e2c7-583d-9203-e96833e5b5c2", "86c468d2-0afc-5eb2-9070-62a4d0f0ba42", "5614e015-a1e0-5c80-bce4-f20f3e689a50", "052a9870-fe4b-5b43-8261-5e523636590b", "79c6ea05-8efd-51b4-8fd2-79613054863d" ], "retrieval_attempts": [ { "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "retrieved_utc": "2026-10-01T19:48:14.465321+00:00", "http_status": 200, "final_url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "bytes_observed": 400524, "body_truncated": false, "sha256": "d31921f2c064d3d3c9d463419147efc12f1445a03766fc0443ed5ef2514ea101" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified.", "requested": true }, { "id": "watchtowr", "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "title": "watchTowr command injection analysis", "published": "2026-09-28", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Rendered web page reviewed", "classification": "exploit_research", "use_or_omission_reason": "Read as technical evidence only; no PoC execution. Delayed processing means request status alone is inconclusive.", "retrieval_evidence": { "id": "watch-771", "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "http_status": 200, "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7", "bytes": 54786 }, "indicator_ids": [], "rule_ids": [ "3ec17436-eb51-5768-9b72-aece3b7d907a", "324d542c-d00d-5ee9-be43-7f6e44d30afa" ], "retrieval_attempts": [ { "id": "watch-771", "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "http_status": 200, "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7", "bytes": 54786 }, { "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "retrieved_utc": "2026-10-01T19:48:16.520346+00:00", "http_status": 200, "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "bytes_observed": 54786, "body_truncated": false, "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "levelblue", "url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "title": "LevelBlue: Observed Exploitation Artifacts and Hunt Indicators", "published": "2026-09-30", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Initial direct retrieval failed; the search result was subsequently opened as full text and its IOC table was reviewed.", "retrieved_utc": "2026-10-01T19:36:45.303996+00:00", "http_status": 200, "final_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "bytes": 106202, "sha256": "7c534ea34d4d14d44fc5481ac5820ec422cffbe023303958c99af6a197d1acd1", "publication_date": "2026-09-30", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified.", "indicator_ids": [ "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", "ioc-b11ecb89-cf23-5101-919e-978c52921122", "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", "ioc-b4150ad2-76af-5932-a838-359da95b1b48", "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", "ioc-a44e9690-5d11-5243-949f-466159b1d305", "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", "ioc-9403c81b-60f9-5a30-ac36-990b112a43e6", "ioc-a4ab0f40-9fa5-5d27-a5c7-ac97e740c74d" ], "rule_ids": [ "db27552c-3c30-5a99-9e82-7ec76c7ba3cd", "11c3813f-894b-51f6-80fb-d7dab0c0e8dd", "5907a6d1-0c74-5eae-9e9b-588c0bab859d" ], "retrieval_attempts": [ { "url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "retrieved_utc": "2026-10-01T19:48:19.598698+00:00", "http_status": 200, "final_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "bytes_observed": 106202, "body_truncated": false, "sha256": "7c534ea34d4d14d44fc5481ac5820ec422cffbe023303958c99af6a197d1acd1" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified.", "requested": true }, { "id": "truesec", "url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", "title": "Truesec: Multiple Critical Vulnerabilities", "published": "2026-09-28", "retrieved": "2026-10-01", "campaign": "2026-09", "access": "Full text reviewed; the source describes these addresses only as possible command-and-control infrastructure.", "retrieved_utc": "2026-10-01T19:36:45.444603+00:00", "http_status": 403, "final_url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", "bytes": 146, "sha256": "32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864", "publication_date": "2026-09-28", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP403; article independently readable through web retrieval, including detection section.", "indicator_ids": [ "ioc-d303c696-5789-5803-9ef3-05942ad7455f", "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "ioc-922dbc10-2b45-5110-8011-cbd7566243d0" ], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", "retrieved_utc": "2026-10-01T19:48:20.131463+00:00", "http_status": 200, "final_url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", "bytes_observed": 61057, "body_truncated": false, "sha256": "ff7a63f2db8c793e37af25876683427ff12723cba3c8fb2ee70763e2a9d1008a" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP403; article independently readable through web retrieval, including detection section.", "requested": true }, { "id": "virustotal-mandiant", "url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", "retrieved_utc": "2026-10-01T19:36:45.064779+00:00", "http_status": 200, "final_url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", "bytes": 7308, "sha256": "082cd84b1d5b2b10427d6c9417ffcc4a9c770ae1ea05a38b9b0943a71c695c09", "publication_date": null, "used": false, "scope": "Public article body and tables; no downloaded malware", "access_notes": "HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection.", "published": null, "retrieved": "2026-10-01T19:36:45.064779+00:00", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", "retrieved_utc": "2026-10-01T19:48:20.226156+00:00", "http_status": 200, "final_url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", "bytes_observed": 7308, "body_truncated": false, "sha256": "082cd84b1d5b2b10427d6c9417ffcc4a9c770ae1ea05a38b9b0943a71c695c09" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection.", "requested": true }, { "id": "cert-eu", "url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "retrieved_utc": "2026-10-01T19:36:45.064857+00:00", "http_status": 403, "final_url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "bytes": 179, "sha256": "1f2e1251b1d5fab2f47bbfe3e09b149064e61571f98a5e02c6ace5f86bacb1d5", "publication_date": "2026-09-28T19:30:00+02:00", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP403; article independently readable through web retrieval, including detection section.", "published": "2026-09-28T19:30:00+02:00", "retrieved": "2026-10-01T19:36:45.064857+00:00", "indicator_ids": [], "rule_ids": [ "d90f1337-428b-5156-adaf-3cba3906c11c", "3ec17436-eb51-5768-9b72-aece3b7d907a" ], "retrieval_attempts": [ { "url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "retrieved_utc": "2026-10-01T19:48:14.464758+00:00", "http_status": 200, "final_url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "bytes_observed": 20501, "body_truncated": false, "sha256": "989be84f751e50c133db328d1bba4e8f4b189872006aa9f57e26e0d27f7fb37a" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP403; article independently readable through web retrieval, including detection section.", "requested": true }, { "id": "unit42", "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "retrieved_utc": "2026-10-01T19:36:45.064965+00:00", "http_status": 200, "final_url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "bytes": 245887, "sha256": "5b83ac0a1cff93b64e04f33cdf234574e49260a6c4f6cfe630326627aca79c37", "publication_date": "2026-09-30", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z.", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00", "indicator_ids": [ "ioc-d303c696-5789-5803-9ef3-05942ad7455f", "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "ioc-f3b37063-7d80-5809-95c5-234731b080cb", "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", "ioc-5d7bb685-145e-596d-af2a-98899689f550", "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", "ioc-88277771-c097-5e0a-be71-fa648013d363", "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", "ioc-f84c61ba-0640-5302-9394-a286f1af181a", "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-505ea29d-cadf-5be7-8b9b-80b4f4f80edc", "ioc-4b5a2e5c-067d-5f1b-a035-b7e5f711b9c0", "ioc-49c42b1b-3068-5421-b851-a3454ed226d2", "ioc-faf2d782-88a4-5c2d-9790-c1a75200decf", "ioc-788900e2-b766-5d79-9e16-0ec3b808865f", "ioc-f5d8fb8e-0bc3-51b5-8468-ca81e4bcd2af", "ioc-49f8d35d-6564-592a-b57b-6355d475beab" ], "rule_ids": [ "d90f1337-428b-5156-adaf-3cba3906c11c", "623305d2-16b6-5710-adc8-b762522af1be", "48774954-8559-562c-902a-2ba8a75f2e2c", "31940357-e53f-57f8-b908-9599b0913fd2" ], "retrieval_attempts": [ { "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "retrieved_utc": "2026-10-01T19:48:17.660240+00:00", "http_status": 200, "final_url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "bytes_observed": 245887, "body_truncated": false, "sha256": "146ce939151dec442511101646fd71dd9cfbaa7b268b13ae56a3aa39f0f9215a" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z.", "requested": true }, { "id": "greynoise", "url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "retrieved_utc": "2026-10-01T19:36:45.065290+00:00", "http_status": 200, "final_url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "bytes": 93784, "sha256": "ae36cd56653edce8ab64062fa3268590c4dc4e73afc3e5e047c477c9c3061583", "publication_date": "2026-09-28", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified.", "published": "2026-09-28", "retrieved": "2026-10-01T19:36:45.065290+00:00", "indicator_ids": [ "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-56976039-ce98-5925-9da5-42f80fe3d742", "ioc-3cd0457e-f3b8-55bf-940c-98b77a6da663" ], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "retrieved_utc": "2026-10-01T19:48:19.458922+00:00", "http_status": 200, "final_url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "bytes_observed": 93784, "body_truncated": false, "sha256": "ae36cd56653edce8ab64062fa3268590c4dc4e73afc3e5e047c477c9c3061583" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified.", "requested": true }, { "id": "greynoise-tag", "url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", "retrieved_utc": "2026-10-01T19:36:45.276736+00:00", "http_status": 403, "final_url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", "bytes": 919, "sha256": "90f9a26059c54265cb90fdb8a75ec9642cfcaa7bab24e05993eebf84ee3e27d6", "publication_date": null, "used": false, "scope": "Public article body and tables; no downloaded malware", "access_notes": "HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag.", "published": null, "retrieved": "2026-10-01T19:36:45.276736+00:00", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", "retrieved_utc": "2026-10-01T19:48:17.831526+00:00", "http_status": 403, "access_error": "Forbidden" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag.", "requested": true }, { "id": "esentire", "url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "retrieved_utc": "2026-10-01T19:36:45.424617+00:00", "http_status": 200, "final_url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "bytes": 165423, "sha256": "5073a9dd5ac0139ceda5ebf35b93ee0e3325c507f59ec1d0c98fc213e9c0e807", "publication_date": "2026-09-29", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified.", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00", "indicator_ids": [ "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", "ioc-1797b953-d34e-57ea-84f5-06686445bee6", "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8" ], "rule_ids": [ "a5f6d8e8-e170-5aae-a7a2-710beac8ee28" ], "retrieval_attempts": [ { "url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "retrieved_utc": "2026-10-01T19:48:19.458377+00:00", "http_status": 200, "final_url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "bytes_observed": 166888, "body_truncated": false, "sha256": "b76b50464cbcc5500df047fedda52858be642e82128b0941a3c4b3d057382a3a" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified.", "requested": true }, { "id": "beazley", "url": "https://labs.beazley.security/advisories/BSL-A1216", "retrieved_utc": "2026-10-01T19:36:45.510941+00:00", "http_status": 200, "final_url": "https://labs.beazley.security/advisories/BSL-A1216", "bytes": 41508, "sha256": "081e474a400e0ba402166423ede8ece9e5e86fd6e2f6481ee51494ee0fd7b301", "publication_date": "2026-09-26", "used": true, "scope": "Public article body and tables; no downloaded malware", "access_notes": "Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved.", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00", "indicator_ids": [ "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", "ioc-dd1dadd2-b5a0-5b09-aa76-490d04588bf0", "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e" ], "rule_ids": [], "retrieval_attempts": [ { "url": "https://labs.beazley.security/advisories/BSL-A1216", "retrieved_utc": "2026-10-01T19:48:16.437816+00:00", "http_status": 200, "final_url": "https://labs.beazley.security/advisories/BSL-A1216", "bytes_observed": 41508, "body_truncated": false, "sha256": "da150923ced344b95264109bfa57b68bf25ee5aef211a54bce1b7535064cec6a" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved.", "requested": true }, { "id": "ifin-event", "url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "http_status": 200, "final_url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "bytes": 47482, "sha256": "a941406df67cb1ae9462a352b444014e3a55c3469eaa59b91aa67d0bec16401e", "source_id": "ifin-event", "retrieved_utc": "2026-10-01T19:44:37.039091+00:00", "published": "2026-09-28", "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039091+00:00", "indicator_ids": [ "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", "ioc-d303c696-5789-5803-9ef3-05942ad7455f", "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", "ioc-b11ecb89-cf23-5101-919e-978c52921122", "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", "ioc-b4150ad2-76af-5932-a838-359da95b1b48", "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", "ioc-a44e9690-5d11-5243-949f-466159b1d305", "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", "ioc-c8992c16-710d-584d-863e-4d154f19beb5", "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "ioc-f3b37063-7d80-5809-95c5-234731b080cb", "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", "ioc-5d7bb685-145e-596d-af2a-98899689f550", "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", "ioc-88277771-c097-5e0a-be71-fa648013d363", "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", "ioc-f84c61ba-0640-5302-9394-a286f1af181a", "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-56976039-ce98-5925-9da5-42f80fe3d742", "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", "ioc-8498baad-3aed-5bb1-884f-65a777f79237", "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", "ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98", "ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66", "ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd", "ioc-64a8e232-9e8a-5d2f-a526-019d24333de5", "ioc-29321922-0dae-5e42-84a3-7c890a994b6b", "ioc-dd8e0595-a5aa-5d86-aaf8-1afab388d2c2" ], "rule_ids": [ "48774954-8559-562c-902a-2ba8a75f2e2c" ], "retrieval_attempts": [ { "url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "retrieved_utc": "2026-10-01T19:48:16.579774+00:00", "http_status": 200, "final_url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "bytes_observed": 47482, "body_truncated": false, "sha256": "a941406df67cb1ae9462a352b444014e3a55c3469eaa59b91aa67d0bec16401e" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": true }, { "id": "ifin-manifest", "url": "https://misp.ifin.network/feed/manifest.json", "http_status": 200, "final_url": "https://misp.ifin.network/feed/manifest.json", "bytes": 58613, "sha256": "e0d17f8aa0f81cac28af72695225fee7e50ffb9152bc7ebb0c33f4de18fd62a0", "source_id": "ifin-manifest", "retrieved_utc": "2026-10-01T19:44:37.039380+00:00", "published": null, "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039380+00:00", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://misp.ifin.network/feed/manifest.json", "retrieved_utc": "2026-10-01T19:48:16.580251+00:00", "http_status": 200, "final_url": "https://misp.ifin.network/feed/manifest.json", "bytes_observed": 58613, "body_truncated": false, "sha256": "e0d17f8aa0f81cac28af72695225fee7e50ffb9152bc7ebb0c33f4de18fd62a0" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": true }, { "id": "ifin-thread", "url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", "http_status": 200, "final_url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", "bytes": 72945, "sha256": "8759efb88c08d4458f1a8ab4282a090c604062d95bdd1a05c831f9ec41ca6600", "source_id": "ifin-thread", "retrieved_utc": "2026-10-01T19:44:37.039382+00:00", "published": null, "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039382+00:00", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", "retrieved_utc": "2026-10-01T19:48:15.994956+00:00", "http_status": 200, "final_url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", "bytes_observed": 72945, "body_truncated": false, "sha256": "7b97e2cf1ddfbe7b4a2f9175247c3ad288d63c3d0621e2cb3c18ed6ce321fe85" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": true }, { "id": "elastic-toml", "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", "http_status": 200, "final_url": "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", "bytes": 9810, "sha256": "a296a6fa0570e39ac7b838f11d6eb40bee27667ba3d40531e9d693f151a3d87c", "source_id": "elastic-toml", "retrieved_utc": "2026-10-01T19:44:37.039384+00:00", "published": "2026-09-28", "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039384+00:00", "indicator_ids": [], "rule_ids": [ "a0f728c2-6c21-50e7-9909-ae5df3b77538" ], "retrieval_attempts": [], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": false }, { "id": "rapid7", "url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", "http_status": 200, "final_url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", "bytes": 521420, "sha256": "ca7b6e485f5f010d70d931b18f693de1d6749ae1c84989ed531a06ed253ffecb", "source_id": "rapid7", "retrieved_utc": "2026-10-01T19:44:37.039385+00:00", "published": "2026-09-28", "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039385+00:00", "indicator_ids": [ "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", "ioc-e3c53f68-c632-5ac9-b63a-3332c4e53e7e", "ioc-f425d9f6-7fae-5179-9a3f-55d8b573ffc8" ], "rule_ids": [ "156c151e-13b0-5dd7-a22c-07bdb4af9327" ], "retrieval_attempts": [ { "url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", "retrieved_utc": "2026-10-01T19:48:19.637183+00:00", "http_status": 200, "final_url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", "bytes_observed": 521420, "body_truncated": false, "sha256": "ca7b6e485f5f010d70d931b18f693de1d6749ae1c84989ed531a06ed253ffecb" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": true }, { "id": "arctic-wolf", "url": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "http_status": 200, "final_url": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "bytes": 6254, "sha256": "1cc0a43f3d5cb3dca5a7e4bb2afc7224303fe892904e67373e2b7b18353587e1", "source_id": "arctic-wolf", "retrieved_utc": "2026-10-01T19:44:37.039386+00:00", "published": "2026-09-30", "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039386+00:00", "indicator_ids": [ "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", "ioc-afd36d04-8867-5378-888a-35110f025138", "ioc-9612b66f-4245-59ae-9405-057c997c80a0", "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", "ioc-262b6f76-9739-549a-b409-588867871d8d", "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", "ioc-c5347a81-e228-5319-98df-39890efbb198", "ioc-01772fb3-a35a-5447-8d2c-7a4665bcea56", "ioc-fb0b6f32-e20b-516a-951b-69158d6910a7", "ioc-a72639b6-e8bd-5954-bc27-e56981f25122", "ioc-f641d7d2-2d09-5490-8a90-d24e12541532", "ioc-e1cab8ac-c435-58ec-a680-0b71d0f945dd", "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3", "ioc-49be21fd-6b54-51f3-8ab5-6c4b65bcd3a6", "ioc-48342f6c-9687-5227-9482-717ab428c77c", "ioc-59dd2664-9887-539e-bc3a-b8972625933a", "ioc-f3832e49-bc15-5a17-a33a-d18bcebaf835", "ioc-3c8206c9-a9db-5cdc-9a56-2b845387e628" ], "rule_ids": [ "985490ff-cbe4-50e7-b4a9-f962543255af", "7ff4a684-f5e1-50b6-b543-ba30ae52818c", "6bb4bd57-96bf-5bf5-b2b2-36ce721d4902", "7f6eb722-0be4-581f-bed5-10d8d3b26247", "0a8f1d34-83bb-5ade-bfc8-1bd45f221a27" ], "retrieval_attempts": [], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": false }, { "id": "sygnia", "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "http_status": 200, "final_url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "bytes": 554280, "sha256": "4fc8e0d83cb2cc7fdd217285f70bf33fb063b1fb3029430972e5276a379d8865", "source_id": "sygnia", "retrieved_utc": "2026-10-01T19:44:37.039387+00:00", "published": "2026-09-30", "access": "Direct HTTP retrieval successful; attacker resources were not requested.", "retrieved": "2026-10-01T19:44:37.039387+00:00", "indicator_ids": [ "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-62a944bc-91a2-55e0-bab3-439c7c6d8ffd", "ioc-47605cce-3519-5bef-99ab-72e3470369a4", "ioc-778a1ee5-2ae7-58d5-90b7-00922171eed0", "ioc-07322dbb-0181-5251-aa32-1845d7735c37", "ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6", "ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e", "ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee", "ioc-13d74ad3-6b70-529b-9e67-89cdc4459ae7", "ioc-76175645-cd94-5b71-839a-3f8735a279d9", "ioc-307fbb23-f927-5c30-9aff-b629abea7ab0" ], "rule_ids": [ "2fe32158-28e3-5512-8640-f713c7f6d2c0", "3ec17436-eb51-5768-9b72-aece3b7d907a", "9fb8bb55-fb55-535a-9b4c-6344f8b08bfe" ], "retrieval_attempts": [ { "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "retrieved_utc": "2026-10-01T19:48:19.714422+00:00", "http_status": 200, "final_url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "bytes_observed": 554280, "body_truncated": false, "sha256": "04a4bd97b36e0aa7b58f2c52f08e8a7d4cd8b46a7a98a442433f6a9f02c1b08b" } ], "used_for_detection": true, "disposition": "detection_reference", "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", "requested": true }, { "id": "CITRIX-CTX697096", "url": "https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html", "title": "NetScaler security bulletin CTX697096", "published": null, "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Canonical article accessible; attachment query-form URL failed. Authoritative fixed builds and exposure preconditions; no public attack IOC list. CVE-88778 additionally requires the Enhanced ISN configuration change. Configuration exposure is not compromise evidence.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [], "used_for_detection": false, "disposition": "guidance_only", "requested": false }, { "id": "CITRIX-SECURITY-BLOG-20260930", "url": "https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/", "title": "NetScaler security guidance, updated September 30", "published": "2026-09-27", "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Official article updated 2026-09-30. IOC logic available via Console/Support, not published here. Patching does not establish cleanup; rebuild when compromise is suspected. 13.1-64.24 avoids the documented 64.23 reboot issue where NS variables exist. Reader comments are not vendor IOC statements and are excluded.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/", "retrieved_utc": "2026-10-01T19:48:14.576535+00:00", "http_status": 403, "access_error": "Forbidden" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "CITRIX-CTX694799", "url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", "title": "Steps after suspected NetScaler compromise", "published": "2025-06-25", "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Preserve disk, logs and memory; record timezone/NTP; isolate; rotate exposed credentials and revoke certificates/private keys; investigate connected systems; rebuild. Packet-engine core generation triggers warm restart. Not a passive log-detection signature. Canonical support listing records modification 2026-05-13.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", "retrieved_utc": "2026-10-01T19:48:16.658089+00:00", "http_status": 200, "final_url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", "bytes_observed": 104944, "body_truncated": false, "sha256": "ebad4b1453adb35719beca6ba98f4d6dd9a8e690cbc0d0c20f50507acd254798" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "NETSCALER-CONSOLE-IOC", "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", "title": "Console indicators-of-compromise detection", "published": null, "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Telemetry required; BLX unsupported. Scan history and detection-logic updates are retained. No Compromise Detected is limited to current checks; failed/skipped scans are not negative findings. Detection internals absent; no invented equivalent rules.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", "retrieved_utc": "2026-10-01T19:48:14.720145+00:00", "http_status": 200, "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", "bytes_observed": 226879, "body_truncated": false, "sha256": "db63e9abcf4da79bea04bf34eaffa5dc1b090386b3ef69c59d229e23e3330ac7" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "NETSCALER-FIM", "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", "title": "File integrity monitoring", "published": "2026-09-07", "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Compares same-build vendor hashes against appliance files; distinguishes modified and added files and scan errors. BLX unsupported. A local log archive cannot reproduce vendor binary-baseline verification, exclusions, ownership/runtime checks or live device signatures.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", "retrieved_utc": "2026-10-01T19:48:14.696478+00:00", "http_status": 200, "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", "bytes_observed": 229446, "body_truncated": false, "sha256": "7be109e0a236ae1b052226efb5a20e31f1faec826b06e1063756645c585483dc" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "NETSCALER-CONSOLE-RELEASES", "url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", "title": "Console service release notes", "published": "2026-09-27", "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "September 27 entry identifies CVE-88771 exposure through version scanning and recommends upgrade. Version-based exposure detection is separate from compromise detection and exact historical patch timing.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", "retrieved_utc": "2026-10-01T19:48:14.730148+00:00", "http_status": 200, "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", "bytes_observed": 472458, "body_truncated": false, "sha256": "39272930fae5d93d787ae027b65d50cd5be0630ccd351a8f1f8d9360b95ae587" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "NEXTRON-20260929", "url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", "title": "THOR NetScaler detection coverage", "published": "2026-09-29", "retrieved": "2026-10-01", "access": "verified", "status": "coverage_mapping_only", "use_or_omission_reason": "Article explicitly withholds rule matching strings/implementation. Its filesystem IOC subset covers 12 checks consolidated into four definitions; 22 checks requiring logs/config/process/ownership/permissions/runtime context are omitted. PoC file detection is not proof of exploitation. No undisclosed rules reconstructed.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", "retrieved_utc": "2026-10-01T19:48:19.620713+00:00", "http_status": 200, "final_url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", "bytes_observed": 294849, "body_truncated": false, "sha256": "1150d1b167674cb370aa4a797bc15988e2ed2cabac9c4efb36c1282f732ea5f5" } ], "used_for_detection": false, "disposition": "coverage_mapping_only", "requested": true }, { "id": "CERTFR-2026-ALE-011", "url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "title": "CERT-FR NetScaler alert", "published": "2026-09-28", "retrieved": "2026-10-01", "access": "verified", "status": "secondary_pattern_provenance", "use_or_omission_reason": "Updated September 30. Reproduces Google DTLS/packet-engine hunting patterns and links YARA. Explicitly says ANSSI has not independently qualified them. Preserve original Google provenance and avoid counting duplicated patterns as independent confirmations.", "indicator_ids": [], "rule_ids": [ "f2b2bc2b-d781-56e6-a464-5731efb85c10", "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", "35bc541e-25f4-5d4b-80e4-b22f2e9ff801" ], "retrieval_attempts": [ { "url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "retrieved_utc": "2026-10-01T19:48:14.465183+00:00", "http_status": 200, "final_url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "bytes_observed": 20907, "body_truncated": false, "sha256": "fae697b8230c9ed435fafb9d1195d9bba3b44a69426bef436b51e64e23d8b638" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "CIRCL-TR100", "url": "https://circl.lu/pub/tr-100/", "title": "CIRCL NetScaler critical vulnerabilities", "published": null, "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Accessible public advisory. Configuration prerequisites, version recommendations, forensic preservation, external SIEM logs and investigation of outbound/internal activity. No additional concrete attack addresses/hashes or detection implementation imported.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://circl.lu/pub/tr-100/", "retrieved_utc": "2026-10-01T19:48:14.465263+00:00", "http_status": 200, "final_url": "https://circl.lu/pub/tr-100/", "bytes_observed": 22914, "body_truncated": false, "sha256": "472cc7606781039780d6bf26790df01c1d60af03de5f660b45f6456bf0bed9e9" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "ACSC-NETSCALER-20260930", "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products", "title": "ACSC NetScaler advisory", "published": "2026-09-28", "retrieved": "2026-10-01", "access": "verified", "status": "guidance_only", "use_or_omission_reason": "Updated September 30: investigate back to at least September 4, 2026. This is a minimum lookback, not proof earlier compromise was impossible. Updated introduction reports Australian exploitation; older background wording still says none reported, so retain update precedence. No public literal IOC table.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products", "retrieved_utc": "2026-10-01T19:48:18.011737+00:00", "access_error": "The read operation timed out" } ], "used_for_detection": false, "disposition": "guidance_only", "requested": true }, { "id": "watchtowr-dtls", "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "title": "watchTowr DTLS analysis", "classification": "exploit_research", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Packet fragmentation/ROP and memory corruption need packet/core evidence; no packet exploit logic is converted to a log success verdict.", "retrieval_evidence": { "id": "watch-772", "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "http_status": 200, "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91", "bytes": 49730 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "watch-772", "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "http_status": 200, "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91", "bytes": 49730 }, { "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "retrieved_utc": "2026-10-01T19:48:16.507096+00:00", "http_status": 200, "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "bytes_observed": 49730, "body_truncated": false, "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "watchtowr-repo", "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "title": "watchTowr artifact generator repository", "classification": "exploit_research", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read source only. Active command injection generator, not a passive scanner. Example output paths classified as PoC markers.", "retrieval_evidence": { "id": "watch-poc", "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", "http_status": 200, "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", "bytes": 1917 }, "indicator_ids": [ "ioc-f2f08d48-92f4-5bf6-b51f-0fdfacc854de", "ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95" ], "rule_ids": [ "3ec17436-eb51-5768-9b72-aece3b7d907a" ], "retrieval_attempts": [ { "id": "watch-poc", "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", "http_status": 200, "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", "bytes": 1917 }, { "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "retrieved_utc": "2026-10-01T19:48:15.980062+00:00", "http_status": 200, "final_url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "bytes_observed": 239508, "body_truncated": false, "sha256": "d57dd2ac1a040e362f969ce587e4454b50ad6ad5ecbbca3df1efd6916b05bed7" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "poppelgaard", "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "title": "Community CTX697096 checker", "classification": "community_aggregation", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read script only. Retain attributed infrastructure and scanner lists separately; community compromise labels are not adopted as local verdicts.", "retrieval_evidence": { "id": "poppelgaard-script", "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", "bytes": 81274 }, "indicator_ids": [ "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", "ioc-d303c696-5789-5803-9ef3-05942ad7455f", "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", "ioc-b4150ad2-76af-5932-a838-359da95b1b48", "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", "ioc-1797b953-d34e-57ea-84f5-06686445bee6", "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", "ioc-56976039-ce98-5925-9da5-42f80fe3d742", "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e", "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", "ioc-8498baad-3aed-5bb1-884f-65a777f79237", "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", "ioc-afd36d04-8867-5378-888a-35110f025138", "ioc-9612b66f-4245-59ae-9405-057c997c80a0", "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", "ioc-262b6f76-9739-549a-b409-588867871d8d", "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", "ioc-c5347a81-e228-5319-98df-39890efbb198", "ioc-4c267388-41ee-5227-ba11-0d5dc7f04865", "ioc-d868065f-7b8f-5967-a28e-999f3374e05e", "ioc-2b52edf3-63e4-5891-99a9-851c701ef966", "ioc-e5099e29-453c-549f-81c6-f021ea7eed4d", "ioc-9fcb074c-31a3-59a2-b5f2-5ff1b0db5a04", "ioc-8b1bf480-3e2c-5048-9b98-88ba4129ae24", "ioc-6157a981-c183-5e32-819e-58da121efccf", "ioc-90649d83-c1f6-578d-be53-189c899946cd", "ioc-63c680c9-b1f1-5aee-a554-5e527f60c2d4", "ioc-4f12e46e-4bf9-53f4-bb19-359adf58ed12", "ioc-d7bb06f3-6e14-51de-b9d3-fd4a62848d70", "ioc-ac2d267d-5c7f-5039-9290-4e67f064d836", "ioc-48bd85f0-1c35-5e7d-9945-ada5a31375df", "ioc-af13acba-cb3e-5da7-81c0-55317f6a40ad", "ioc-1ad4e7d7-d388-5b18-a21a-a1498eac5db2", "ioc-1174ab82-cd5e-51fe-99a6-437284c2ce45", "ioc-f68754cd-53d6-5124-a672-16b8719e6abc", "ioc-c080888d-00bf-5cf7-8949-fea4f573dd63", "ioc-0b7b1700-fb00-534d-ae61-6ef9a4b41949", "ioc-30c0c3e4-d183-5519-aba6-1be38489baf9", "ioc-73292c42-9c98-5ce7-a8a5-b39ed9c93d18", "ioc-2a11ac33-78e9-5681-baad-a8249056008f", "ioc-f132a2db-c271-54b1-ab24-9c6d11ac8776", "ioc-9a75ddc5-7ac4-5ef0-9e50-b01f3a7e4471", "ioc-06e8ec49-8c49-504e-9b3d-e25ad61bd027", "ioc-7b789a76-cc5a-5833-8f42-13256ec561d8", "ioc-107a87f4-b8a8-54a9-9a11-6b2057c01bb2", "ioc-b05a2dce-c9f6-583c-878e-96f21ca94fc4", "ioc-ea140046-4e0d-5e16-a150-a5a68f69b635", "ioc-66cfbde1-07c1-560f-b967-bcc78846ca0a", "ioc-e7e4adf2-30dc-5f99-8744-dd8dd33d46f3", "ioc-c54202eb-b7f3-5197-90ae-385d2eef2d19", "ioc-124ac29e-4c30-5018-9cad-5b4112767c69", "ioc-020335a1-0dfd-521b-a90d-7e85acd1827a", "ioc-902af158-00bf-5776-b73f-dfdcc74d7b94", "ioc-a2773efd-0847-5503-9e9b-bdc1e749668e", "ioc-4f2b7167-4b7f-5f3f-a62f-a7e54565de90", "ioc-9ec5e7f2-5eef-5915-b9ac-50d426d4ec8f", "ioc-b1b5375a-1395-586c-8b62-be709809345b", "ioc-45acd1bd-635f-54c3-b9ff-2262ffa20798", "ioc-c538409c-b054-51a1-ab89-f8891525914a", "ioc-b9506317-73f8-5d26-81e2-3e3ae03e24f4", "ioc-20d469dc-580b-59c9-9672-b42cff9f681e", "ioc-a9b0db77-074b-50d8-9116-8514f95cceb4", "ioc-a0fa80e9-ea58-5c88-baef-ddb81abd1edd", "ioc-aade0d13-89ea-5606-afc8-55f79ef679fe", "ioc-c896dcc8-b975-54b6-9084-f8c446f4b0a5", "ioc-c30a8ea6-1e2b-56d9-8437-75ac25954af4", "ioc-1c09e2e0-9033-596e-a603-e11472506a5d", "ioc-1ba4bd5c-bfe3-567b-a0b1-a59a8d64488a", "ioc-52f895d6-25f7-520e-9082-4dfdc6667c04", "ioc-bd0a1634-8c1d-517d-89c5-b51d6ffb60de", "ioc-6db74410-e5b2-55f8-9442-9a7aad436b26", "ioc-ee997307-6c49-5643-b348-8da03cbb7b78", "ioc-d6b9aa88-aa2c-5dd4-82c1-5801baa6dc84", "ioc-8272b998-64de-5808-afe8-46b2eda0fb9f", "ioc-4a7f36a8-64df-55d9-9d4b-5165ee7ddeb8", "ioc-a8a466ff-728a-5dcb-b817-6f3c8b1cc98b", "ioc-5c19f867-d3b6-57fa-834c-1f85bf1b26f5", "ioc-44fb3383-9982-5e76-bccd-767b3b4424eb", "ioc-7e5fe335-5960-5d7b-ba98-450e10001601", "ioc-a7e40372-95a9-5e86-80b0-50c39a7cd74b", "ioc-42b1233a-f1fc-5fe8-9494-91b5ae207095", "ioc-9b69e39c-44a1-5acc-af64-af5be1827253", "ioc-6e25a2ab-a760-5589-8a66-41106fe9ca78", "ioc-336b324e-32fd-5811-bcc9-c2f4583f6037", "ioc-876a80d0-36c5-5483-b284-9a6a87937905", "ioc-4a7041f8-d718-5f93-9591-92d3012dffa5", "ioc-267e2670-40b8-51bc-9f83-7827b02a8302", "ioc-d5aa72b1-1997-5f33-bbe1-7184bec9996b", "ioc-b4f5b41c-47aa-5288-89d0-bae6a3f29b3c", "ioc-5584f65a-17db-519c-b766-9887c285674a", "ioc-ef2d4d25-3815-58bb-8527-8e7a4295eb15", "ioc-51fd15cc-c5f6-5249-9f80-7bc44fadc7fd", "ioc-6a9e81f7-5ac3-59b6-ae5d-0f0bff55e5fe", "ioc-a2eab928-f892-5dbb-8864-79169e5c3e25", "ioc-c620f066-7706-5c69-b5a6-b26ebdc502ae", "ioc-ce847b0d-eaed-551d-9361-6c2ab92f66db", "ioc-28e03118-efc5-54d6-83d4-a346b9448cfb", "ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b", "ioc-29cf0672-a8c2-588e-b51e-bcd965b9aecb", "ioc-41e3003d-d7c1-5fd6-b593-2c0f46a09220", "ioc-3b13e849-8762-5d90-b0f5-6e0f9bfa6da3", "ioc-74e8790e-27ee-5c3e-9788-8e0e950ed02e" ], "rule_ids": [ "b72b1566-d05a-5fca-8cb4-229fcb59cc95", "5fbd05f0-df10-513d-acfc-e856fa90dd70", "83dd2ce5-c181-534b-b8b4-0b58dd9501d5" ], "retrieval_attempts": [ { "id": "poppelgaard-script", "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", "bytes": 81274 }, { "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "retrieved_utc": "2026-10-01T19:48:15.257637+00:00", "http_status": 200, "final_url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "bytes_observed": 428972, "body_truncated": false, "sha256": "2cde3ef8303176a6ca27a1b3765fb2c6931cda7b57458dbd9799ff94cec6d89a" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "technion", "url": "https://github.com/technion/netscaler_scanner", "title": "Community NetScaler scanner", "classification": "community_research", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read source only. Adds author-reported theme webshell paths. Mandiant-derived checks keep original attribution. Build-only CVE-88778 conclusion is not imported.", "retrieval_evidence": { "id": "technion-script", "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", "bytes": 9785 }, "indicator_ids": [ "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "ioc-b6be1d96-6a37-5350-bade-d162ede2dae5", "ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9" ], "rule_ids": [], "retrieval_attempts": [ { "id": "technion-script", "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", "bytes": 9785 }, { "url": "https://github.com/technion/netscaler_scanner", "retrieved_utc": "2026-10-01T19:48:15.823462+00:00", "http_status": 200, "final_url": "https://github.com/technion/netscaler_scanner", "bytes_observed": 257755, "body_truncated": false, "sha256": "ac51c80839a53eb8aaa244fec51c6a842bc125757cb3f6c2655e76b8fba81a45" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "deyda-guide", "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "title": "Community assessment guide", "classification": "community_guidance", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Guide and corrected current script reviewed; no script executed. Known-clean platform hashes and normal diagnostic paths are not attack IOCs.", "retrieval_evidence": { "id": "deyda-guide", "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "http_status": 200, "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "sha256": "ec5ad90195e6f4542da677c7f3a45ac26a9cd3df96406db13707834abcb50997", "bytes": 416158 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "deyda-guide", "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "http_status": 200, "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "sha256": "ec5ad90195e6f4542da677c7f3a45ac26a9cd3df96406db13707834abcb50997", "bytes": 416158 }, { "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "retrieved_utc": "2026-10-01T19:48:18.017371+00:00", "http_status": 200, "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", "bytes_observed": 416158, "body_truncated": false, "sha256": "54ddaf26c9446b00cb27b97cb8bfb276de97ecdab965fa1d9795fc1469fcef0b" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "deyda-requested-script", "url": "https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh", "title": "Requested community script path", "classification": "unavailable", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Requested path unavailable (raw equivalent HTTP404). Repository tree identifies deyda-netscaler-ioc-check.sh as current filename.", "retrieval_evidence": { "id": "deyda-script", "url": "https://raw.githubusercontent.com/Deyda/Security/main/netscaler-ioc-check.sh", "error": "HTTP Error 404: Not Found" }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "deyda-script", "url": "https://raw.githubusercontent.com/Deyda/Security/main/netscaler-ioc-check.sh", "error": "HTTP Error 404: Not Found" }, { "url": "https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh", "retrieved_utc": "2026-10-01T19:48:14.933384+00:00", "http_status": 404, "access_error": "Not Found" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "deyda-script", "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "title": "Current community assessment script", "classification": "community_aggregation", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Corrected filename discovered from repository tree. Read source only; no copied scanner execution or known-good hash import.", "retrieval_evidence": { "id": "deyda-script-corrected", "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "http_status": 200, "sha256": "555a17b97c6e407430cf00bcf842b4ccb9eb48564c78a8b63cdbfbc57f1a3471", "bytes": 82695 }, "indicator_ids": [ "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", "ioc-56976039-ce98-5925-9da5-42f80fe3d742", "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2" ], "rule_ids": [ "742a1576-1923-58ce-801a-813820e41169", "b72b1566-d05a-5fca-8cb4-229fcb59cc95", "67e7c3f5-d648-516e-97fc-79ceb36453fb" ], "retrieval_attempts": [ { "id": "deyda-script-corrected", "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "http_status": 200, "sha256": "555a17b97c6e407430cf00bcf842b4ccb9eb48564c78a8b63cdbfbc57f1a3471", "bytes": 82695 } ], "used_for_detection": true, "disposition": "detection_reference", "requested": false }, { "id": "ncsc-nl-2025", "url": "https://github.com/NCSC-NL/citrix-2025", "title": "NCSC-NL historical forensic checks", "classification": "government_historical", "published": "2025-08-06", "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "2025 campaign, not evidence of 2026 CVE coverage. Extracted string observables; binary ROP, image metadata, timestomping, permissions and live checks remain external.", "retrieval_evidence": { "id": "ncsc-core-yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", "http_status": 200, "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", "bytes": 12223 }, "indicator_ids": [ "ioc-be1e1a69-053d-5f29-8142-f3d907a7fb50", "ioc-9e92512b-49c6-576e-b491-9eadb7d13866", "ioc-1c979393-6e8e-523c-b9b0-1f3014c50412", "ioc-4b4f876e-b6a3-53f4-b372-c6953909c1f6", "ioc-69ff3fac-a6fc-5988-bafe-301a29a099f6", "ioc-58d728b8-87d2-5175-a1df-49467cd38262", "ioc-27fb7299-cf82-5839-a8d3-027ba6fe9bbf", "ioc-c3dc5cf6-51d6-5421-a096-cb5418f99d6f", "ioc-406a5932-92ac-501f-afa2-b6c866702938", "ioc-36638420-6816-5109-8048-31d3256b6882", "ioc-41d198a3-3a03-5082-b7fb-8181df570fee", "ioc-781c7a15-9413-5958-9cb2-128a16e18fab", "ioc-a0f0fa36-4a34-543f-b932-a2b09d3a9598", "ioc-6b7771cb-6d28-5f49-b1ec-024e1412076e", "ioc-88e6d8ed-e9ee-5080-9df6-20744cd131cd", "ioc-6d38ccdd-5436-5a80-9f61-e207fce26301", "ioc-30475a4b-1a2a-5daa-99c3-c9ca447058fb", "ioc-8554391a-cad4-5561-a54b-48fd507995e2", "ioc-fafd0e8b-53b2-52bf-a57c-5e6601f02137", "ioc-42937439-f9b2-5eea-b619-347c7d04988b", "ioc-d660fdf4-7eaa-5b94-a6e3-c5289f69ce4f", "ioc-f297377d-3c83-5e8a-9ed3-c73815436fe0" ], "rule_ids": [ "742a1576-1923-58ce-801a-813820e41169", "3fafb627-665f-5caa-9a4b-229086449433" ], "retrieval_attempts": [ { "id": "ncsc-core-yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", "http_status": 200, "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", "bytes": 12223 }, { "url": "https://github.com/NCSC-NL/citrix-2025", "retrieved_utc": "2026-10-01T19:48:15.250881+00:00", "http_status": 200, "final_url": "https://github.com/NCSC-NL/citrix-2025", "bytes_observed": 262588, "body_truncated": false, "sha256": "9d8aa1ea424c613253eb446eb1c62b356df93232d1a1f7fb8192bbaedba8fa13" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "fox-it", "url": "https://github.com/fox-it/citrix-netscaler-triage", "title": "Fox-IT forensic image triage", "classification": "forensic_tool", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read implementation. Core utility needs disk and RAM-disk evidence; string heuristics adapted with PHP context only. Expected SUID binaries are not attack IOCs.", "retrieval_evidence": { "id": "fox-ioc", "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", "http_status": 200, "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", "bytes": 8472 }, "indicator_ids": [], "rule_ids": [ "3fafb627-665f-5caa-9a4b-229086449433" ], "retrieval_attempts": [ { "id": "fox-ioc", "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", "http_status": 200, "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", "bytes": 8472 }, { "url": "https://github.com/fox-it/citrix-netscaler-triage", "retrieved_utc": "2026-10-01T19:48:15.414243+00:00", "http_status": 200, "final_url": "https://github.com/fox-it/citrix-netscaler-triage", "bytes_observed": 333545, "body_truncated": false, "sha256": "da6e3d27d6c9541f75270387415c6e1e14e0ac039780605c925816a2e891318c" } ], "used_for_detection": true, "disposition": "detection_reference", "requested": true }, { "id": "poppelgaard-script", "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "title": "Reviewed source component: poppelgaard-script", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "poppelgaard-script", "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", "bytes": 81274 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "poppelgaard-script", "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", "bytes": 81274 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "technion-script", "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "title": "Reviewed source component: technion-script", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "technion-script", "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", "bytes": 9785 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "technion-script", "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "http_status": 200, "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", "bytes": 9785 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "fox-ioc", "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", "title": "Reviewed source component: fox-ioc", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "fox-ioc", "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", "http_status": 200, "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", "bytes": 8472 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "fox-ioc", "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", "http_status": 200, "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", "bytes": 8472 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "ncsc-checks", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", "title": "Reviewed source component: ncsc-checks", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "ncsc-checks", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", "http_status": 200, "sha256": "02c7badf490f42c3f7084fab42bab2e5dfff76f5630cb071c8c0eb19e1d6c210", "bytes": 3889 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "ncsc-checks", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", "http_status": 200, "sha256": "02c7badf490f42c3f7084fab42bab2e5dfff76f5630cb071c8c0eb19e1d6c210", "bytes": 3889 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "ncsc-core-yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", "title": "Reviewed source component: ncsc-core-yara", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "ncsc-core-yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", "http_status": 200, "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", "bytes": 12223 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "ncsc-core-yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", "http_status": 200, "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", "bytes": 12223 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "ncsc-live", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", "title": "Reviewed source component: ncsc-live", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "ncsc-live", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", "http_status": 200, "sha256": "abd98a108998af6ec95229002a90a0eae320546c7fd08ae93bef5724390aafa0", "bytes": 2068 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "ncsc-live", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", "http_status": 200, "sha256": "abd98a108998af6ec95229002a90a0eae320546c7fd08ae93bef5724390aafa0", "bytes": 2068 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "watch-poc", "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", "title": "Reviewed source component: watch-poc", "classification": "source_component", "published": null, "retrieved": "2026-10-01", "access": "Rendered web page reviewed", "use_or_omission_reason": "Read-only source supporting parent repository review.", "retrieval_evidence": { "id": "watch-poc", "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", "http_status": 200, "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", "bytes": 1917 }, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "id": "watch-poc", "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", "http_status": 200, "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", "bytes": 1917 } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "ncsc-php_webshell_rules.yara", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/php_webshell_rules.yara", "title": "NCSC-referenced general webshell YARA collection", "retrieved": "2026-10-01", "published": null, "http_status": 200, "sha256": "e4c6b3816be2bb7d8795d3b6c266d617f1c871e7f72c35af5dcd7326775bca15", "classification": "general_filesystem_yara", "use_or_omission_reason": "Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "ncsc-thor-webshells.yar", "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/thor-webshells.yar", "title": "NCSC-referenced general webshell YARA collection", "retrieved": "2026-10-01", "published": null, "http_status": 200, "sha256": "922db101bc89d8a3e928ac1a94762a2512e2cb6592c05b3e810bc61176067c67", "classification": "general_filesystem_yara", "use_or_omission_reason": "Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.", "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": false }, { "id": "requested-77a190a3", "url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", "retrieved": "2026-10-01", "access": "Alternative canonical/raw source used.", "used": false, "alternate_source_ids": [ "elastic-toml" ], "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", "published": null, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", "retrieved_utc": "2026-10-01T19:48:15.389901+00:00", "http_status": 200, "final_url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", "bytes_observed": 336859, "body_truncated": false, "sha256": "607e1bf8c2a222c7ea979a10d65a1eed45125ce8106322d7e864d8c44acf7110" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "requested-7e6e5286", "url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "retrieved": "2026-10-01", "access": "Alternative canonical/raw source used.", "used": false, "alternate_source_ids": [ "arctic-wolf" ], "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", "published": null, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "retrieved_utc": "2026-10-01T19:48:15.790062+00:00", "http_status": 200, "final_url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "bytes_observed": 271763, "body_truncated": false, "sha256": "99c12e78ebe5d346b49ca31c9d00d6cd94f58b7cac0f2b741809ebedc1c491a1" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "requested-f8052bbe", "url": "https://support.citrix.com/external/article?articleNumber=CTX697096", "retrieved": "2026-10-01", "access": "Alternative canonical/raw source used.", "used": false, "alternate_source_ids": [ "CITRIX-CTX697096" ], "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", "published": null, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://support.citrix.com/external/article?articleNumber=CTX697096", "retrieved_utc": "2026-10-01T19:48:17.659872+00:00", "http_status": 200, "final_url": "https://support.citrix.com/external/article?articleNumber=CTX697096", "bytes_observed": 197121, "body_truncated": false, "sha256": "9ef6a55ea7a6e83997095cc6b93df868a2f4c03a0f276fab76bf4d4f314103aa" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true }, { "id": "requested-6c93ceb2", "url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", "retrieved": "2026-10-01", "access": "No independently verified content available in the research records.", "used": false, "alternate_source_ids": [], "use_or_omission_reason": "Unavailable or not verified; no indicator invented.", "published": null, "indicator_ids": [], "rule_ids": [], "retrieval_attempts": [ { "url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", "retrieved_utc": "2026-10-01T19:48:19.060733+00:00", "http_status": 200, "final_url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", "bytes_observed": 26278, "body_truncated": false, "sha256": "0803d9e1e16f8698e61deaa9fa9bd67dcc9e878e646cd7fb0fab0a0b713292a3" } ], "used_for_detection": false, "disposition": "guidance_or_access_limitation", "requested": true } ], "indicators": [ { "id": "ioc-8498baad-3aed-5bb1-884f-65a777f79237", "type": "domain", "value": "echvista.com", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source domain — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "domain", "misp_to_ids": true, "attribute_uuid": "d3797228-94d1-4358-b5a8-e868b9de25bd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated campaign domain", "confidence": "low", "description": "Community-aggregated campaign domain", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Community-aggregated campaign domain", "Secondary-source artifact; validate cited original report." ], "role": "Community-aggregated campaign domain; Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c5347a81-e228-5319-98df-39890efbb198", "type": "domain", "value": "entretiensol.com", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated campaign domain", "confidence": "low", "description": "Community-aggregated campaign domain", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated campaign domain", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated campaign domain; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-dd1dadd2-b5a0-5b09-aa76-490d04588bf0", "type": "domain", "value": "httpworkbench.com", "status": "reference_only", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "reference_only", "role": "out_of_band_callback", "description": "Shared callback service, context and exact subdomain required; not blanket malicious ownership.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] } ], "source": [ "beazley" ], "roles": [ "out_of_band_callback" ], "role": "out_of_band_callback", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4b4f876e-b6a3-53f4-b372-c6953909c1f6", "type": "ipv4", "value": "101.99.91.107", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e7e4adf2-30dc-5f99-8744-dd8dd33d46f3", "type": "ipv4", "value": "104.203.50.26", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d303c696-5789-5803-9ef3-05942ad7455f", "type": "ipv4", "value": "104.248.244.66", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "truesec", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "observations": [ { "status": "reference_only", "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "reconnaissance", "description": "Version-fingerprinting requests observed Aug21–22.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "potential_c2", "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", "confidence": "suspected", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "63ac6c2d-e151-4cbc-8c20-18b5de1f191c", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "truesec", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "potential_c2", "reconnaissance", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; potential_c2; reconnaissance; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-5d7bb685-145e-596d-af2a-98899689f550", "type": "ipv4", "value": "104.248.74.206", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 7). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "81a2c1fb-c32d-46a2-8280-340901da1e37", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-88277771-c097-5e0a-be71-fa648013d363", "type": "ipv4", "value": "104.28.215.136", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "shared_proxy_infrastructure", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "confidence": "low", "status": "context_only", "original_comment": "Cloudflare WARP VPN egress — requested nsgclient18.deb, nsgsupport.deb, nsgpackage64.deb (Sep 9-11). Legitimate consumer VPN used by millions; blocking would cause false positives. Evaluate WARP usage in your environment first. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": false, "attribute_uuid": "38cd859a-efb5-48e8-a4d5-834b4bd538cf", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "context_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "shared_proxy_infrastructure" ], "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", "type": "ipv4", "value": "104.28.215.137", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "shared_proxy_infrastructure", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "confidence": "low", "status": "context_only", "original_comment": "Cloudflare WARP VPN egress — .deb webshell requests + continuous GetUserName page polling (Sep 10-27). Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": false, "attribute_uuid": "6dd6fa40-8166-4bed-9f3e-a9d19b8f39d9", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "context_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "shared_proxy_infrastructure" ], "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", "type": "ipv4", "value": "104.28.247.136", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "shared_proxy_infrastructure", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "confidence": "low", "status": "context_only", "original_comment": "Cloudflare WARP VPN egress — requested nsgclient18.deb, nsgsupport.deb, nsgpackage64.deb (Sep 9-11). Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": false, "attribute_uuid": "c99cf527-3734-4e00-893d-60ee8d2b0664", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "context_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "shared_proxy_infrastructure" ], "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-f84c61ba-0640-5302-9394-a286f1af181a", "type": "ipv4", "value": "104.28.247.137", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "shared_proxy_infrastructure", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "confidence": "low", "status": "context_only", "original_comment": "Cloudflare WARP VPN egress — continuous GetUserName page polling (Sep 10-27), continued 2.5 days past last webshell request. Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": false, "attribute_uuid": "878895c1-7b92-41d1-a0d6-985c6d5e8e83", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "context_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Shared Cloudflare WARP egress; not suitable for blanket blocking.", "shared_proxy_infrastructure" ], "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-1ba4bd5c-bfe3-567b-a0b1-a59a8d64488a", "type": "ipv4", "value": "113.137.102.68", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-af13acba-cb3e-5da7-81c0-55317f6a40ad", "type": "ipv4", "value": "120.28.233.211", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9b69e39c-44a1-5acc-af64-af5be1827253", "type": "ipv4", "value": "125.122.56.47", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-902af158-00bf-5776-b73f-dfdcc74d7b94", "type": "ipv4", "value": "130.94.106.141", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", "type": "ipv4", "value": "130.94.42.226", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", "type": "ipv4", "value": "134.175.71.50", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", "type": "ipv4", "value": "137.184.91.207", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 7). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "1e2879f8-45c4-4e0a-8271-6b94a809bf9f", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-48bd85f0-1c35-5e7d-9945-ada5a31375df", "type": "ipv4", "value": "137.220.53.135", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e5099e29-453c-549f-81c6-f021ea7eed4d", "type": "ipv4", "value": "138.199.200.90", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", "type": "ipv4", "value": "138.28.234.38", "status": "reference_only", "source_ids": [ "beazley", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "reference_only", "role": "attempted_dns_exfiltration", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "attempted_dns_exfiltration" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; attempted_dns_exfiltration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-778a1ee5-2ae7-58d5-90b7-00922171eed0", "type": "ipv4", "value": "138.68.21.29", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Temporal and service-path association; attacker role unconfirmed.", "role": "Temporal and service-path association; attacker role unconfirmed.", "confidence": "medium", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Temporal and service-path association; attacker role unconfirmed." ], "role": "Temporal and service-path association; attacker role unconfirmed.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", "type": "ipv4", "value": "139.180.152.138", "status": "reference_only", "source_ids": [ "esentire", "ifin-event", "poppelgaard", "truesec", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "observations": [ { "status": "reference_only", "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Webshell delivery", "description": "Webshell delivery", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "webshell_delivery", "description": "Three-stage injection activity observed Sep21.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "potential_c2", "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", "confidence": "suspected", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "739ec179-995c-48bf-b6d1-30bd2a11e30a", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "ifin-event", "poppelgaard", "truesec", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Webshell delivery", "potential_c2", "reference_indicator", "webshell_delivery" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Webshell delivery; potential_c2; reference_indicator; webshell_delivery", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d7bb06f3-6e14-51de-b9d3-fd4a62848d70", "type": "ipv4", "value": "142.93.205.229", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", "type": "ipv4", "value": "142.93.85.227", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 6). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "af34ca73-9a82-427b-9ddc-f325e6a31aae", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", "type": "ipv4", "value": "143.198.7.94", "status": "reference_only", "source_ids": [ "beazley", "ifin-event", "mandiant", "poppelgaard" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Publicly reported infrastructure.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "scanning_and_staging", "description": "scanning_and_staging", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "scanning_and_staging", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Scanning and staging infrastructure — Mandiant/GTIG observed during CVE-2026-88772 exploitation campaign. Source: Mandiant blog 2026-09-29.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "38aca0c2-2848-4e72-8721-612ee0cc0ef7", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "ifin-event", "mandiant", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "reference_indicator", "scanning_and_staging" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reference_indicator; scanning_and_staging", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", "type": "ipv4", "value": "144.172.108.78", "status": "reference_only", "source_ids": [ "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", "type": "ipv4", "value": "149.104.78.141", "status": "reference_only", "source_ids": [ "beazley", "esentire", "greynoise", "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "exploitation_attempt", "description": "Sep24 sensor activity; attacker failed to gain a foothold on the observed sensor.", "confidence": "published", "source_ids": [ "greynoise" ], "source_urls": [ "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "original_status": "reference_only", "source_dates": [ { "id": "greynoise", "published": "2026-09-28", "retrieved": "2026-10-01T19:36:45.065290+00:00" } ] }, { "status": "reference_only", "role": "exploitation_attempt", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Exploitation source — GreyNoise observed CVE-2026-88771 exploitation from this IP on 2026-09-24 07:32:19 UTC, 3+ days before public disclosure. Detected via Project Swarm sensor. Also attempted CitrixBleed 2 (CVE-2025-5777) and generic ${IFS} RCE. Source: GreyNoise blog 2026-09-28.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "6d167a7b-709f-4394-9413-b616df7ede68", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "esentire", "greynoise", "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source", "exploitation_attempt" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; exploitation_attempt", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e3c53f68-c632-5ac9-b63a-3332c4e53e7e", "type": "ipv4", "value": "149.104.78.208", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "observations": [ { "description": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", "role": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", "confidence": "high", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "original_status": "reference_only", "source_dates": [ { "id": "rapid7", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039385+00:00" } ] } ], "source": [ "rapid7" ], "roles": [ "Exploitation attempt source at 2026-09-20 14:28:43 UTC." ], "role": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", "type": "ipv4", "value": "149.28.29.221", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "f571e002-ac7f-4e3b-86a2-55cd586cbf35", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-1ad4e7d7-d388-5b18-a21a-a1498eac5db2", "type": "ipv4", "value": "149.28.58.71", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", "type": "ipv4", "value": "153.75.82.220", "status": "reference_only", "source_ids": [ "arctic-wolf", "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", "type": "ipv4", "value": "154.217.251.226", "status": "reference_only", "source_ids": [ "beazley", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "reference_only", "role": "dtls_scanning", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "dtls_scanning" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; dtls_scanning", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", "type": "ipv4", "value": "157.254.167.12", "status": "reference_only", "source_ids": [ "beazley", "ifin-event", "mandiant", "poppelgaard" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Publicly reported infrastructure.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "exploitation_and_backdoor_installation", "description": "exploitation_and_backdoor_installation", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "exploitation_and_backdoor_installation", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "NetScaler exploitation and installation of basic web shell backdoor — Mandiant/GTIG observed during CVE-2026-88772 campaign. Source: Mandiant blog 2026-09-29.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "a85695f2-df5f-46a6-a55d-0c4e74b3084e", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "ifin-event", "mandiant", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "exploitation_and_backdoor_installation", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; exploitation_and_backdoor_installation; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d868065f-7b8f-5967-a28e-999f3374e05e", "type": "ipv4", "value": "158.94.209.12", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-30c0c3e4-d183-5519-aba6-1be38489baf9", "type": "ipv4", "value": "159.26.103.184", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4f12e46e-4bf9-53f4-bb19-359adf58ed12", "type": "ipv4", "value": "159.65.104.231", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", "type": "ipv4", "value": "162.243.36.88", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of NetScaler exploitation attempts", "description": "Source of NetScaler exploitation attempts", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "7eef96c3-96a6-4c54-b313-fff9c2ecc7c1", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Source of NetScaler exploitation attempts", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", "type": "ipv4", "value": "162.33.178.9", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgbuild.deb and nsgsupport.deb from /vpn/scripts/linux/ (Sep 14). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "380b92e7-24c6-499e-acd6-0d32b1e4aebb", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6157a981-c183-5e32-819e-58da121efccf", "type": "ipv4", "value": "165.227.201.112", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", "type": "ipv4", "value": "167.99.111.203", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 5). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "46e5a6d7-0ab8-498c-95fe-51ccc483e987", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-07322dbb-0181-5251-aa32-1845d7735c37", "type": "ipv4", "value": "170.64.176.26", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Associated IR activity, precise role unspecified.", "role": "Associated IR activity, precise role unspecified.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Associated IR activity, precise role unspecified." ], "role": "Associated IR activity, precise role unspecified.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4f2b7167-4b7f-5f3f-a62f-a7e54565de90", "type": "ipv4", "value": "171.106.10.118", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8b1bf480-3e2c-5048-9b98-88ba4129ae24", "type": "ipv4", "value": "172.247.44.85", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-90649d83-c1f6-578d-be53-189c899946cd", "type": "ipv4", "value": "173.231.39.244", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", "type": "ipv4", "value": "173.40.135.209", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of NetScaler exploitation attempts", "description": "Source of NetScaler exploitation attempts", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "5116a55c-775b-4e2b-8838-46ab4818f5bd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Source of NetScaler exploitation attempts", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-267e2670-40b8-51bc-9f83-7827b02a8302", "type": "ipv4", "value": "176.65.148.54", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", "type": "ipv4", "value": "177.4.12.11", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a9b0db77-074b-50d8-9116-8514f95cceb4", "type": "ipv4", "value": "178.218.40.232", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b1b5375a-1395-586c-8b62-be709809345b", "type": "ipv4", "value": "178.66.43.241", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f132a2db-c271-54b1-ab24-9c6d11ac8776", "type": "ipv4", "value": "180.242.113.168", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ac2d267d-5c7f-5039-9290-4e67f064d836", "type": "ipv4", "value": "182.101.54.57", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", "type": "ipv4", "value": "185.156.46.162", "status": "reference_only", "source_ids": [ "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-66cfbde1-07c1-560f-b967-bcc78846ca0a", "type": "ipv4", "value": "185.170.55.89", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-45acd1bd-635f-54c3-b9ff-2262ffa20798", "type": "ipv4", "value": "185.209.15.246", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", "type": "ipv4", "value": "185.243.41.247", "status": "reference_only", "source_ids": [ "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Campaign infrastructure", "description": "Campaign infrastructure", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "poppelgaard" ], "roles": [ "Campaign infrastructure", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Campaign infrastructure; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-aade0d13-89ea-5606-afc8-55f79ef679fe", "type": "ipv4", "value": "191.37.30.194", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", "type": "ipv4", "value": "193.149.176.207", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Most active .deb webshell requester — requested nsgbuild.deb daily Sep 15-24. Also sent GetUserName page requests Sep 10-27. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "591ee741-5efc-4fd0-90c6-8cc45d009e3d", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-42b1233a-f1fc-5fe8-9494-91b5ae207095", "type": "ipv4", "value": "194.242.130.193", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9fcb074c-31a3-59a2-b5f2-5ff1b0db5a04", "type": "ipv4", "value": "194.26.29.88", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-107a87f4-b8a8-54a9-9a11-6b2057c01bb2", "type": "ipv4", "value": "194.28.195.90", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-58d728b8-87d2-5175-a1df-49467cd38262", "type": "ipv4", "value": "194.36.37.5", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-2a11ac33-78e9-5681-baad-a8249056008f", "type": "ipv4", "value": "197.52.9.138", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f68754cd-53d6-5124-a672-16b8719e6abc", "type": "ipv4", "value": "198.13.159.233", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-020335a1-0dfd-521b-a90d-7e85acd1827a", "type": "ipv4", "value": "206.232.71.215", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-47605cce-3519-5bef-99ab-72e3470369a4", "type": "ipv4", "value": "209.250.236.77", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Temporal association; attacker role unconfirmed.", "role": "Temporal association; attacker role unconfirmed.", "confidence": "medium", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Temporal association; attacker role unconfirmed." ], "role": "Temporal association; attacker role unconfirmed.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-1797b953-d34e-57ea-84f5-06686445bee6", "type": "ipv4", "value": "216.203.21.233", "status": "reference_only", "source_ids": [ "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", "type": "ipv4", "value": "216.245.184.164", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "reported_campaign_infrastructure", "description": "Published network IOC; request alone does not prove successful execution.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "a1961d43-2434-4101-ab9b-f7dae1e6b4f1", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "reported_campaign_infrastructure" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6e25a2ab-a760-5589-8a66-41106fe9ca78", "type": "ipv4", "value": "23.132.164.35", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-1174ab82-cd5e-51fe-99a6-437284c2ce45", "type": "ipv4", "value": "23.234.111.22", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c896dcc8-b975-54b6-9084-f8c446f4b0a5", "type": "ipv4", "value": "23.234.74.48", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", "type": "ipv4", "value": "23.27.143.20", "status": "reference_only", "source_ids": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported payload infrastructure.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Exploit source and payload host", "description": "Exploit source and payload host", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload host", "description": "Payload host", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Exploit source and payload host — hosted main.py reverse-shell payload at port 9000. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "39dd1a7b-a301-4469-b8be-b16e28852ce8", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploit source and payload host", "Payload host", "Reported payload, persistence or network artifact.", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploit source and payload host; Payload host; Reported payload, persistence or network artifact.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ea140046-4e0d-5e16-a150-a5a68f69b635", "type": "ipv4", "value": "31.13.192.160", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", "type": "ipv4", "value": "31.56.197.72", "status": "reference_only", "source_ids": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported payload infrastructure.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload-hosting infrastructure", "description": "Payload-hosting infrastructure", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload host", "description": "Payload host", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Payload-hosting infrastructure — hosted 'lula' payload on port 9090. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "51b90587-d364-47b1-93bc-3430464f1b89", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Payload host", "Payload-hosting infrastructure", "Reported payload, persistence or network artifact.", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Payload host; Payload-hosting infrastructure; Reported payload, persistence or network artifact.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", "type": "ipv4", "value": "34.90.151.231", "status": "reference_only", "source_ids": [ "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Reconnaissance + webshell delivery", "description": "Reconnaissance + webshell delivery", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reconnaissance + webshell delivery" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reconnaissance + webshell delivery", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c54202eb-b7f3-5197-90ae-385d2eef2d19", "type": "ipv4", "value": "37.19.221.171", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-1c979393-6e8e-523c-b9b0-1f3014c50412", "type": "ipv4", "value": "38.60.245.99", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4a7041f8-d718-5f93-9591-92d3012dffa5", "type": "ipv4", "value": "4.246.63.96", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-876a80d0-36c5-5483-b284-9a6a87937905", "type": "ipv4", "value": "44.226.128.41", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a7e40372-95a9-5e86-80b0-50c39a7cd74b", "type": "ipv4", "value": "44.252.255.141", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", "type": "ipv4", "value": "45.141.21.130", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported reverse-shell destination on TCP port 443.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Reverse-shell C2 infrastructure", "description": "Reverse-shell C2 infrastructure", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Reverse-shell C2 infrastructure — customsnmpd (overwritten by main.py) connects to this IP:443 and redirects stdio to socket for interactive /bin/sh. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "9d7bbb21-2c8d-45c9-8097-93affe01b2b7", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact.", "Reverse-shell C2 infrastructure", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.; Reverse-shell C2 infrastructure; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-124ac29e-4c30-5018-9cad-5b4112767c69", "type": "ipv4", "value": "45.143.167.96", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-73292c42-9c98-5ce7-a8a5-b39ed9c93d18", "type": "ipv4", "value": "45.249.89.172", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", "type": "ipv4", "value": "45.61.136.143", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "reported_campaign_infrastructure", "description": "Published network IOC; request alone does not prove successful execution.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "f42c32d7-623d-47f4-b740-f5eb8f235b5d", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "reported_campaign_infrastructure" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-62a944bc-91a2-55e0-bab3-439c7c6d8ffd", "type": "ipv4", "value": "45.76.34.141", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Present in malicious AAA events.", "role": "Present in malicious AAA events.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Present in malicious AAA events." ], "role": "Present in malicious AAA events.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0b7b1700-fb00-534d-ae61-6ef9a4b41949", "type": "ipv4", "value": "46.150.68.55", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b11ecb89-cf23-5101-919e-978c52921122", "type": "ipv4", "value": "47.230.224.154", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of NetScaler exploitation attempts", "description": "Source of NetScaler exploitation attempts", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "caea63d1-b268-49a4-aaec-4d008a404cc4", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Source of NetScaler exploitation attempts", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d6b9aa88-aa2c-5dd4-82c1-5801baa6dc84", "type": "ipv4", "value": "47.239.205.29", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-52f895d6-25f7-520e-9082-4dfdc6667c04", "type": "ipv4", "value": "47.243.125.255", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a8a466ff-728a-5dcb-b817-6f3c8b1cc98b", "type": "ipv4", "value": "47.76.102.1", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8272b998-64de-5808-afe8-46b2eda0fb9f", "type": "ipv4", "value": "47.76.132.65", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-5c19f867-d3b6-57fa-834c-1f85bf1b26f5", "type": "ipv4", "value": "47.76.63.52", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-bd0a1634-8c1d-517d-89c5-b51d6ffb60de", "type": "ipv4", "value": "47.76.92.109", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a0fa80e9-ea58-5c88-baef-ddb81abd1edd", "type": "ipv4", "value": "49.36.107.103", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-2b52edf3-63e4-5891-99a9-851c701ef966", "type": "ipv4", "value": "5.188.206.226", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-336b324e-32fd-5811-bcc9-c2f4583f6037", "type": "ipv4", "value": "54.70.59.128", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a2773efd-0847-5503-9e9b-bdc1e749668e", "type": "ipv4", "value": "58.187.56.89", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", "type": "ipv4", "value": "62.133.62.80", "status": "reference_only", "source_ids": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported payload infrastructure.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload-hosting infrastructure", "description": "Payload-hosting infrastructure", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload host", "description": "Payload host", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Payload-hosting infrastructure — hosted payload at /xd7h/x on port 80. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "381c3c9c-d634-4787-a2b9-e1875622b3fb", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Payload host", "Payload-hosting infrastructure", "Reported payload, persistence or network artifact.", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Payload host; Payload-hosting infrastructure; Reported payload, persistence or network artifact.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-7e5fe335-5960-5d7b-ba98-450e10001601", "type": "ipv4", "value": "64.177.93.71", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-63c680c9-b1f1-5aee-a554-5e527f60c2d4", "type": "ipv4", "value": "64.225.103.14", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", "type": "ipv4", "value": "64.94.85.67", "status": "reference_only", "source_ids": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard", "sygnia" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "status": "reference_only", "description": "Reported payload infrastructure.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Exploit, payload, and exfiltration infrastructure", "description": "Exploit, payload, and exfiltration infrastructure", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload host", "description": "Payload host", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Exploit, payload, and exfiltration infrastructure — hosted update_c08937.pl, received exfiltrated config archive at /update_result_3567cs.tgz. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "2ff40621-5f80-4129-a6bf-b8b039107d0f", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "description": "Embedded download destination.", "role": "Embedded download destination.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "esentire", "ifin-event", "levelblue", "poppelgaard", "sygnia" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Embedded download destination.", "Exploit, payload, and exfiltration infrastructure", "Payload host", "Reported payload, persistence or network artifact.", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Embedded download destination.; Exploit, payload, and exfiltration infrastructure; Payload host; Reported payload, persistence or network artifact.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", "type": "ipv4", "value": "66.135.19.18", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_source", "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Requested nsgclient18.deb and nsgser18.deb from /vpn/scripts/linux/ (Sep 4). Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "a0ff6345-60ed-4e77-b40f-fb8fc416ac76", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "webshell_request_source" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", "type": "ipv4", "value": "66.227.183.84", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "reported_campaign_infrastructure", "description": "Published network IOC; request alone does not prove successful execution.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "93820aa4-2c25-4602-8c43-9f986184fef6", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "reported_campaign_infrastructure" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", "type": "ipv4", "value": "68.178.160.183", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-20d469dc-580b-59c9-9672-b42cff9f681e", "type": "ipv4", "value": "68.46.140.222", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", "type": "ipv4", "value": "70.172.58.168", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of NetScaler exploitation attempts", "description": "Source of NetScaler exploitation attempts", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "8fa632b8-98b7-48bd-bca9-38b2ac0c3c16", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Source of NetScaler exploitation attempts", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c30a8ea6-1e2b-56d9-8437-75ac25954af4", "type": "ipv4", "value": "72.73.231.73", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-06e8ec49-8c49-504e-9b3d-e25ad61bd027", "type": "ipv4", "value": "73.43.85.7", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", "type": "ipv4", "value": "77.83.199.39", "status": "reference_only", "source_ids": [ "esentire", "ifin-event", "poppelgaard", "sygnia", "truesec", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "observations": [ { "status": "reference_only", "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Webshell delivery", "description": "Webshell delivery", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "reconnaissance", "description": "Version-fingerprinting requests observed Aug21–22.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "webshell_delivery", "description": "Three-stage injection activity observed Sep21.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "potential_c2", "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", "confidence": "suspected", "source_ids": [ "truesec" ], "source_urls": [ "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" ], "original_status": "reference_only", "source_dates": [ { "id": "truesec", "published": "2026-09-28", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "417301e8-4243-4b3f-a425-c059a2cba30d", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Fake-CSS payload request source.", "role": "Fake-CSS payload request source.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "esentire", "ifin-event", "poppelgaard", "sygnia", "truesec", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Fake-CSS payload request source.", "Webshell delivery", "potential_c2", "reconnaissance", "reference_indicator", "webshell_delivery" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Fake-CSS payload request source.; Webshell delivery; potential_c2; reconnaissance; reference_indicator; webshell_delivery", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4c267388-41ee-5227-ba11-0d5dc7f04865", "type": "ipv4", "value": "78.128.113.10", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", "type": "ipv4", "value": "78.135.96.136", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "c2215107-0d28-4383-aa10-fc6d529c83dd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f3b37063-7d80-5809-95c5-234731b080cb", "type": "ipv4", "value": "78.47.24.217", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "reconnaissance", "description": "Version-fingerprinting requests observed Aug21–22.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "webshell_delivery", "description": "Three-stage injection activity observed Sep21.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Fingerprinting host (Aug 21-22) — requested /admin_ui/common/css/ns/ui.css across 100+ NetScaler systems alongside 104.248.244.66 and 77.83.199.39. Earliest activity Unit42 identified. Source: Unit42 threat brief.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "599ede4b-f664-429f-b8e2-6943e0d3a73c", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "reconnaissance", "webshell_delivery" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; reconnaissance; webshell_delivery", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-44fb3383-9982-5e76-bccd-767b3b4424eb", "type": "ipv4", "value": "8.210.119.74", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ee997307-6c49-5643-b348-8da03cbb7b78", "type": "ipv4", "value": "8.210.67.91", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6db74410-e5b2-55f8-9442-9a7aad436b26", "type": "ipv4", "value": "8.217.173.25", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4a7f36a8-64df-55d9-9d4b-5165ee7ddeb8", "type": "ipv4", "value": "8.218.219.56", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", "type": "ipv4", "value": "80.240.22.229", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "c3e5352e-25a4-4c42-81ce-d08ac311369b", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", "type": "ipv4", "value": "82.167.14.7", "status": "reference_only", "source_ids": [ "beazley", "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "Exploitation source", "description": "Exploitation source", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "execution_test_marker", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "esentire", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Exploitation source", "execution_test_marker" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; execution_test_marker", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9ec5e7f2-5eef-5915-b9ac-50d426d4ec8f", "type": "ipv4", "value": "82.24.212.15", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-69ff3fac-a6fc-5988-bafe-301a29a099f6", "type": "ipv4", "value": "84.55.67.133", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9a75ddc5-7ac4-5ef0-9e50-b01f3a7e4471", "type": "ipv4", "value": "85.117.117.248", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", "type": "ipv4", "value": "85.203.46.191", "status": "reference_only", "source_ids": [ "beazley", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "reference_only", "role": "reconnaissance", "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "reference_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "reconnaissance" ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reconnaissance", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c080888d-00bf-5cf7-8949-fea4f573dd63", "type": "ipv4", "value": "85.221.203.85", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b4150ad2-76af-5932-a838-359da95b1b48", "type": "ipv4", "value": "87.224.84.82", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of configuration-staging attempt", "description": "Source of configuration-staging attempt", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of configuration-staging attempt — CVE-2026-88771 exploitation to copy/archive ns.conf. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "4d0a8a52-57b4-474a-afae-8eac272eaca6", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "Source of configuration-staging attempt", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise; Source of configuration-staging attempt; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9e92512b-49c6-576e-b491-9eadb7d13866", "type": "ipv4", "value": "88.119.169.150", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-7b789a76-cc5a-5833-8f42-13256ec561d8", "type": "ipv4", "value": "88.180.103.22", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", "type": "ipv4", "value": "89.36.231.206", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "febf08c9-738a-4fde-a351-e1a422b60071", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", "type": "ipv4", "value": "89.44.80.7", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Reported payload, persistence or network artifact." ], "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-be1e1a69-053d-5f29-8142-f3d907a7fb50", "type": "ipv4", "value": "91.107.190.236", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", "type": "ipv4", "value": "91.195.240.123", "status": "reference_only", "source_ids": [ "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "3ede1c06-834b-468b-8213-a9027617af09", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", "type": "ipv4", "value": "92.118.204.229", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported source of an exploitation attempt.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Source of command-execution testing", "description": "Source of command-execution testing", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", "confidence": "low", "status": "reference_only", "original_comment": "Source of command-execution testing — CVE-2026-88771 whoami probe. Source: LevelBlue THOR team.", "misp_type": "ip-dst", "misp_to_ids": true, "attribute_uuid": "853f84e1-855f-4ad3-a21e-ae37d0c3ac3c", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "confidence": "low", "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Comment reports source activity despite ip-dst field; direction conflict retained.", "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", "Source of command-execution testing", "reference_indicator" ], "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Source of command-execution testing; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b9506317-73f8-5d26-81e2-3e3ae03e24f4", "type": "ipv4", "value": "93.177.60.233", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c538409c-b054-51a1-ab89-f8891525914a", "type": "ipv4", "value": "94.190.77.195", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-1c09e2e0-9033-596e-a603-e11472506a5d", "type": "ipv4", "value": "95.229.84.239", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b05a2dce-c9f6-583c-878e-96f21ca94fc4", "type": "ipv4", "value": "95.63.246.50", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "confidence": "low", "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "observation_category": "scanner", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" ], "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9ec7945d-865e-596c-a7f4-0a6da1c81f0a", "type": "ipv4", "value": "107.172.221.57", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-50fff1fb-6c39-5b8a-a596-308e3eaf6a1e", "type": "ipv4", "value": "144.126.221.237", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3c6a1c17-8362-5c47-82d2-2d43e6daccef", "type": "ipv4", "value": "149.248.21.5", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0dc83b54-5562-5446-9fec-5d2114810676", "type": "ipv4", "value": "149.28.121.199", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6704dc2d-7a73-51bc-8d3b-feaba5d8ac8f", "type": "ipv4", "value": "172.98.178.104", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-60aac534-cde8-50b3-bb2d-798f451acb8d", "type": "ipv4", "value": "66.55.159.67", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-51b89e76-fb7a-5eae-9f05-06413d0e3db2", "type": "ipv4", "value": "88.218.105.254", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-41d198a3-3a03-5082-b7fb-8181df570fee", "type": "literal", "value": "/var/tmp/sh", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-49f8d35d-6564-592a-b57b-6355d475beab", "type": "literal", "value": "7489a0f93c67fa5cdaeb4b921d90594d", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "implant_configuration", "description": "RC4 key derived from passphrase; NOT a malware-file MD5", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "implant_configuration" ], "role": "implant_configuration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-64a8e232-9e8a-5d2f-a526-019d24333de5", "type": "literal", "value": "AddHandler application/x-httpd-php .deb", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Persistence Method A — httpd.conf modification treating .deb files as PHP scripts. Allows web shells with .deb extensions in /netscaler/gui/vpn/scripts/linux. Check /etc/httpd.conf. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "dab5c8b4-4e66-48cf-b742-8b486e51ddb2", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-29321922-0dae-5e42-84a3-7c890a994b6b", "type": "literal", "value": "AddHandler application/x-httpd-php .sig", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Persistence Method B — httpd.conf modification treating .sig files as PHP scripts. Enables .sig web shells routed via AliasMatch from .ico requests. Check /etc/httpd.conf. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "3ff4f3b2-c610-4dab-a4b5-579c9e9b75cd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-dd8e0595-a5aa-5d86-aaf8-1afab388d2c2", "type": "literal", "value": "AliasMatch ^/vpn/media/(.+).ico$ /var/netscaler/gui/vpn/scripts/linux/$1.sig", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Persistence Method B — Apache AliasMatch routing .ico image requests to .sig web shells in script directory. Maps /vpn/media/*.ico to /var/netscaler/gui/vpn/scripts/linux/*.sig. Check /etc/httpd.conf. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "43cbb59c-f805-4b42-aebe-8d27b5903125", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", "type": "literal", "value": "HTTP_NSC_CLIENTTYPE", "status": "reference_only", "source_ids": [ "ifin-event", "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Reported header indicator.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "C2 HTTP header used by e6ee7c85.sig web shells — Base64-encoded payload execution via eval(). Native NetScaler SetEnvIf header abused for C2 channel. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "4c523e4d-f09a-44d7-8cff-a233861a0c18", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "mandiant" ], "roles": [ "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", "type": "literal", "value": "HTTP_NSC_LDAP", "status": "reference_only", "source_ids": [ "ifin-event", "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Reported header indicator.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "C2 HTTP header used by nsginstaller.deb web shells — Base64-encoded command execution via shell_exec(). Native NetScaler SetEnvIf header abused for C2 channel. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "25ed0ba9-a5b3-4079-bb9b-b2c0a2b2c9d6", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "mandiant" ], "roles": [ "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", "type": "literal", "value": "HTTP_X_UX", "status": "reference_only", "source_ids": [ "ifin-event", "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Reported header indicator.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "WHIPSHOT chunked C2 transport header — concatenates HTTP_X_UX_0 through HTTP_X_UX_95 (and HTTP_X_UX), Base64-decodes the stream, forwards to SLAPSHOT proxy via loopback socket. Source: Mandiant/GTIG.", "misp_type": "other", "misp_to_ids": true, "attribute_uuid": "fbe1145c-f86a-458e-aed6-77a17bec89dd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "mandiant" ], "roles": [ "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e", "type": "literal", "value": "NX-CVE-OK", "status": "reference_only", "source_ids": [ "beazley", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "context_only", "role": "scanner_or_poc_marker", "description": "Research/testing marker; does not identify an attacker or prove compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "context_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict", "scanner_or_poc_marker" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict; scanner_or_poc_marker", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-5584f65a-17db-519c-b766-9887c285674a", "type": "literal", "value": "PoCbit", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f5d8fb8e-0bc3-51b5-8468-ca81e4bcd2af", "type": "literal", "value": "Rhfajaf1H992", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "implant_configuration", "description": "nsg64.deb authentication passphrase", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "implant_configuration" ], "role": "implant_configuration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c620f066-7706-5c69-b5a6-b26ebdc502ae", "type": "literal", "value": "c88771.json", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a71cff59-53a9-55a7-8c3e-ae19f9072b18", "type": "literal", "value": "e6ee7c85.sig", "status": "reference_only", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "status": "reference_only", "role": "webshell_filename", "description": "Mandiant published example; filenames vary between victims.", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] } ], "source": [ "mandiant" ], "roles": [ "webshell_filename" ], "role": "webshell_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-788900e2-b766-5d79-9e16-0ec3b808865f", "type": "literal", "value": "e826d7ddf3c85920", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "implant_configuration", "description": "Specific implant CsrfToken password; variants may differ.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "implant_configuration" ], "role": "implant_configuration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a2eab928-f892-5dbb-8864-79169e5c3e25", "type": "literal", "value": "exec-ok", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a0f0fa36-4a34-543f-b932-a2b09d3a9598", "type": "literal", "value": "fnoc.dptth", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6b7771cb-6d28-5f49-b1ec-024e1412076e", "type": "literal", "value": "galf_php", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f297377d-3c83-5e8a-9ed3-c73815436fe0", "type": "literal", "value": "gifnocsn", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-88e6d8ed-e9ee-5080-9df6-20744cd131cd", "type": "literal", "value": "hctaMselif", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-781c7a15-9413-5958-9cb2-128a16e18fab", "type": "literal", "value": "hs/pmt/rav/", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ef2d4d25-3815-58bb-8527-8e7a4295eb15", "type": "literal", "value": "httpworkbench", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-406a5932-92ac-501f-afa2-b6c866702938", "type": "literal", "value": "logon/LogonPoint/LogonUI.php", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-27fb7299-cf82-5839-a8d3-027ba6fe9bbf", "type": "literal", "value": "logon/LogonPoint/index.php", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-36638420-6816-5109-8048-31d3256b6882", "type": "literal", "value": "logon/LogonPoint/plugin_index.php", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c3dc5cf6-51d6-5421-a096-cb5418f99d6f", "type": "literal", "value": "logon/LogonPoint/tmindex.php", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d660fdf4-7eaa-5b94-a6e3-c5289f69ce4f", "type": "literal", "value": "ltcehcapa", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6d38ccdd-5436-5a80-9f61-e207fce26301", "type": "literal", "value": "lufecarg", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", "type": "literal", "value": "ns-88771-poc", "status": "reference_only", "source_ids": [ "beazley", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://labs.beazley.security/advisories/BSL-A1216" ], "observations": [ { "status": "context_only", "role": "scanner_or_poc_marker", "description": "Research/testing marker; does not identify an attacker or prove compromise.", "confidence": "secondary_reported", "source_ids": [ "beazley" ], "source_urls": [ "https://labs.beazley.security/advisories/BSL-A1216" ], "original_status": "context_only", "source_dates": [ { "id": "beazley", "published": "2026-09-26", "retrieved": "2026-10-01T19:36:45.510941+00:00" } ] }, { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "beazley", "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict", "scanner_or_poc_marker" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict; scanner_or_poc_marker", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-faf2d782-88a4-5c2d-9790-c1a75200decf", "type": "literal", "value": "nsgbuild.deb", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_filename", "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "webshell_request_filename" ], "role": "webshell_request_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e38612e8-8199-5afb-9615-1733293a94d1", "type": "literal", "value": "nsgclient.sig", "status": "reference_only", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "status": "reference_only", "role": "webshell_filename", "description": "Mandiant published example; filenames vary between victims.", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] } ], "source": [ "mandiant" ], "roles": [ "webshell_filename" ], "role": "webshell_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e16b4205-4942-5cb7-a6b4-d218dcd3f2f5", "type": "literal", "value": "nsginstaller.deb", "status": "reference_only", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "status": "reference_only", "role": "installer_filename", "description": "Mandiant published example; filenames vary between victims.", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] } ], "source": [ "mandiant" ], "roles": [ "installer_filename" ], "role": "installer_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-49c42b1b-3068-5421-b851-a3454ed226d2", "type": "literal", "value": "nsgpackage64.deb", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_filename", "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "webshell_request_filename" ], "role": "webshell_request_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-505ea29d-cadf-5be7-8b9b-80b4f4f80edc", "type": "literal", "value": "nsgser18.deb", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_filename", "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "webshell_request_filename" ], "role": "webshell_request_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4b5a2e5c-067d-5f1b-a035-b7e5f711b9c0", "type": "literal", "value": "nsgsupport.deb", "status": "reference_only", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_request_filename", "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] } ], "source": [ "unit42" ], "roles": [ "webshell_request_filename" ], "role": "webshell_request_filename", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d5aa72b1-1997-5f33-bbe1-7184bec9996b", "type": "literal", "value": "nx_verify.html", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-30475a4b-1a2a-5daa-99c3-c9ca447058fb", "type": "literal", "value": "php.IUnogoL", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-42937439-f9b2-5eea-b619-347c7d04988b", "type": "literal", "value": "php.xednimt", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8554391a-cad4-5561-a54b-48fd507995e2", "type": "literal", "value": "relacsten.cr/gifnocsn", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6a9e81f7-5ac3-59b6-ae5d-0f0bff55e5fe", "type": "literal", "value": "scanner-probe", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a4ab0f40-9fa5-5d27-a5c7-ac97e740c74d", "type": "literal", "value": "sec_monitor", "status": "reference_only", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Reported account name.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Privileged account created by payload", "description": "Privileged account created by payload", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] } ], "source": [ "levelblue" ], "roles": [ "Privileged account created by payload", "reference_indicator" ], "role": "Privileged account created by payload; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-fafd0e8b-53b2-52bf-a57c-5e6601f02137", "type": "literal", "value": "tnioPnogoL", "status": "reference_only", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "observations": [ { "status": "reference_only", "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "confidence": "medium", "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", "campaign": "2025", "source_ids": [ "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025" ], "original_status": "reference_only", "source_dates": [ { "id": "ncsc-nl-2025", "published": "2025-08-06", "retrieved": "2026-10-01" } ] } ], "source": [ "ncsc-nl-2025" ], "roles": [ "Historical 2025 forensic string indicator; no 2026 attribution implied" ], "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-51fd15cc-c5f6-5249-9f80-7bc44fadc7fd", "type": "literal", "value": "vp_probe_nonexist", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b4f5b41c-47aa-5288-89d0-bae6a3f29b3c", "type": "literal", "value": "wtw888", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Public scanner/PoC or command-output marker; not a malware verdict", "confidence": "low", "description": "Public scanner/PoC or command-output marker; not a malware verdict", "observation_category": "poc_marker", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Public scanner/PoC or command-output marker; not a malware verdict" ], "role": "Public scanner/PoC or command-output marker; not a malware verdict", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ce847b0d-eaed-551d-9361-6c2ab92f66db", "type": "path", "value": "/.x", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-307fbb23-f927-5c30-9aff-b629abea7ab0", "type": "path", "value": "/logon/LogonPoint/custom/receiver.min..css", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3cd0457e-f3b8-55bf-940c-98b77a6da663", "type": "path", "value": "/logon/LogonPoint/custom/receiver.min.css", "status": "reference_only", "source_ids": [ "greynoise" ], "source_urls": [ "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "observations": [ { "status": "reference_only", "role": "webshell_alias", "description": "webshell_alias", "confidence": "published", "source_ids": [ "greynoise" ], "source_urls": [ "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "original_status": "reference_only", "source_dates": [ { "id": "greynoise", "published": "2026-09-28", "retrieved": "2026-10-01T19:36:45.065290+00:00" } ] } ], "source": [ "greynoise" ], "roles": [ "webshell_alias" ], "role": "webshell_alias", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-29cf0672-a8c2-588e-b51e-bcd965b9aecb", "type": "path", "value": "/netscaler/ns_gui/admin_ui/e.txt", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-41e3003d-d7c1-5fd6-b593-2c0f46a09220", "type": "path", "value": "/netscaler/ns_gui/admin_ui/log.txt", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-76175645-cd94-5b71-839a-3f8735a279d9", "type": "path", "value": "/netscaler/ns_gui/vpn/c88771.json", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c8992c16-710d-584d-863e-4d154f19beb5", "type": "path", "value": "/tmp/.uxdlock", "status": "reference_only", "source_ids": [ "ifin-event", "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Hunting reference, not a local finding.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "published_artifact", "description": "published_artifact", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SLAPSHOT process lock artifact — fcntl.flock exclusive lock file. Presence indicates active/recent SLAPSHOT proxy daemon execution. Source: Mandiant/GTIG.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "28eef7f3-dacc-4516-9dae-14f3764dfd96", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "mandiant" ], "roles": [ "Secondary-source artifact; validate cited original report.", "published_artifact", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; published_artifact; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", "type": "path", "value": "/tmp/.uxdport", "status": "reference_only", "source_ids": [ "ifin-event", "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "status": "reference_only", "description": "Hunting reference, not a local finding.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "published_artifact", "description": "published_artifact", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SLAPSHOT active port artifact — Python proxy daemon (WHIPSHOT companion) writes ephemeral loopback port number here. Check `ls -la /tmp/.uxdport*`. Presence indicates active/recent SLAPSHOT execution. Source: Mandiant/GTIG.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "1249987a-22ad-4ae7-b776-588e9040d930", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "mandiant" ], "roles": [ "Secondary-source artifact; validate cited original report.", "published_artifact", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; published_artifact; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-28e03118-efc5-54d6-83d4-a346b9448cfb", "type": "path", "value": "/tmp/lula", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", "type": "path", "value": "/tmp/update_result_3567cs.tgz", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Artifact path; a textual reference does not prove that the file exists.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Staged NetScaler configuration archive", "description": "Staged NetScaler configuration archive", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Staged NetScaler configuration archive — /flash/nsconfig tarball created by update_c08937.pl for exfiltration. Payload deletes this after upload attempt; absence does not indicate no execution. Source: LevelBlue THOR team.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "d784b8e2-038b-42a0-a340-bbc3856c17d9", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Secondary-source artifact; validate cited original report.", "Staged NetScaler configuration archive", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; Staged NetScaler configuration archive; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f2f08d48-92f4-5bf6-b51f-0fdfacc854de", "type": "path", "value": "/tmp/watchTowr", "status": "reference_only", "source_ids": [ "watchtowr-repo" ], "source_urls": [ "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" ], "observations": [ { "status": "reference_only", "role": "PoC/example output marker; attribution and execution require corroboration", "confidence": "low", "description": "PoC/example output marker; attribution and execution require corroboration", "observation_category": "poc_marker", "source_ids": [ "watchtowr-repo" ], "source_urls": [ "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" ], "original_status": "reference_only", "source_dates": [ { "id": "watchtowr-repo", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "watchtowr-repo" ], "roles": [ "PoC/example output marker; attribution and execution require corroboration" ], "role": "PoC/example output marker; attribution and execution require corroboration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", "type": "path", "value": "/var/1.py", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context", "Reported payload, persistence or network artifact." ], "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3b13e849-8762-5d90-b0f5-6e0f9bfa6da3", "type": "path", "value": "/var/netscaler/gui/admin_ui/e.txt", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-74e8790e-27ee-5c3e-9788-8e0e950ed02e", "type": "path", "value": "/var/netscaler/gui/admin_ui/log.txt", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f425d9f6-7fae-5179-9a3f-55d8b573ffc8", "type": "path", "value": "/var/netscaler/gui/vpn/c", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "observations": [ { "description": "Configuration archive staging destination.", "role": "Configuration archive staging destination.", "confidence": "high", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "original_status": "reference_only", "source_dates": [ { "id": "rapid7", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039385+00:00" } ] } ], "source": [ "rapid7" ], "roles": [ "Configuration archive staging destination." ], "role": "Configuration archive staging destination.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-13d74ad3-6b70-529b-9e67-89cdc4459ae7", "type": "path", "value": "/var/netscaler/gui/vpn/scripts/linux/1bd8a664.sig", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a44e9690-5d11-5243-949f-466159b1d305", "type": "path", "value": "/var/netscaler/logon/LogonPoint/.local_journal", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Artifact path; a textual reference does not prove that the file exists.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "PHP web shell", "description": "PHP web shell", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "PHP webshell deployed by update_c08937.pl — dotfile in LogonPoint. Mapped via httpd.conf AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and randomized hex variants). Provides remote command execution + file upload/download. Source: LevelBlue THOR team.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "c17b7bd1-b183-4164-9c91-eb81e4d0ab50", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "PHP web shell", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "PHP web shell; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", "type": "path", "value": "/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver", "status": "reference_only", "source_ids": [ "greynoise", "ifin-event", "rapid7", "sygnia", "technion", "unit42" ], "source_urls": [ "https://github.com/technion/netscaler_scanner", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "status": "reference_only", "role": "webshell_artifact", "description": "webshell_artifact", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "status": "reference_only", "role": "webshell_artifact", "description": "webshell_artifact", "confidence": "published", "source_ids": [ "greynoise" ], "source_urls": [ "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "original_status": "reference_only", "source_dates": [ { "id": "greynoise", "published": "2026-09-28", "retrieved": "2026-10-01T19:36:45.065290+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "PHP webshell path on NetScaler — dotfile in LogonPoint/custom directory. Survives reboot and upgrade to 73.37. Created 2026-09-24 06:52:51 UTC on primary node, synced to secondary via HA. Check httperror.log for SIGHUP restarts at same timestamp.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "80a7c380-969a-4787-ba79-d88192f470d9", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Hidden PHP webshell.", "role": "Hidden PHP webshell.", "confidence": "high", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "original_status": "reference_only", "source_dates": [ { "id": "rapid7", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039385+00:00" } ] }, { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] }, { "status": "reference_only", "role": "Author-reported webshell path; text reference does not establish file existence", "confidence": "medium", "description": "Author-reported webshell path; text reference does not establish file existence", "source_ids": [ "technion" ], "source_urls": [ "https://github.com/technion/netscaler_scanner" ], "original_status": "reference_only", "source_dates": [ { "id": "technion", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "greynoise", "ifin-event", "rapid7", "sygnia", "technion", "unit42" ], "roles": [ "Author-reported webshell path; text reference does not establish file existence", "Hidden PHP webshell.", "Investigation-derived artifact or routing path.", "Secondary-source artifact; validate cited original report.", "webshell_artifact" ], "role": "Author-reported webshell path; text reference does not establish file existence; Hidden PHP webshell.; Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; webshell_artifact", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", "type": "path", "value": "/var/netscaler/logon/LogonPoint/xua.html", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Artifact path; a textual reference does not prove that the file exists.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Staged configuration archive", "description": "Staged configuration archive", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Staged configuration archive — /flash/nsconfig tarball placed in LogonPoint directory for web-accessible retrieval. Created via `tar${IFS}czf${IFS}/var/netscaler/logon/LogonPoint/xua.html${IFS}/flash/nsconfig`. Source: LevelBlue THOR team.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "b8cd56d6-3e76-410a-b3ca-89082557d880", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Secondary-source artifact; validate cited original report.", "Staged configuration archive", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; Staged configuration archive; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", "type": "path", "value": "/var/netscaler/logon/insight-new.js", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue", "sygnia" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "status": "reference_only", "description": "Artifact path; a textual reference does not prove that the file exists.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Staged NetScaler configuration", "description": "Staged NetScaler configuration", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Staged NetScaler configuration — ns.conf copied to web-accessible logon directory for retrieval. Created via `cat /flash/nsconfig/ns.conf>/var/netscaler/logon/insight-new.js`. Source: LevelBlue THOR team.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "2a223be1-7a2a-4829-b003-7d085fdd0ddd", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "ifin-event", "levelblue", "sygnia" ], "roles": [ "Investigation-derived artifact or routing path.", "Secondary-source artifact; validate cited original report.", "Staged NetScaler configuration", "reference_indicator" ], "role": "Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; Staged NetScaler configuration; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9403c81b-60f9-5a30-ac36-990b112a43e6", "type": "path", "value": "/var/python/bin/customsnmpd", "status": "reference_only", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Artifact path; a textual reference does not prove that the file exists.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "context_only", "role": "modified_legitimate_component", "description": "Context only: legitimate appliance path becomes relevant when overwritten by reverse-shell code.", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "context_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] } ], "source": [ "levelblue" ], "roles": [ "modified_legitimate_component", "reference_indicator" ], "role": "modified_legitimate_component; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": true }, { "id": "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", "type": "path", "value": "/var/tmp/.nsmon/.cfg", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context", "Reported payload, persistence or network artifact." ], "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", "type": "path", "value": "/var/tmp/.nsmon/.state", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context", "Reported payload, persistence or network artifact." ], "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-262b6f76-9739-549a-b409-588867871d8d", "type": "path", "value": "/var/tmp/.nsmon/nsmon.pl", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context", "Reported payload, persistence or network artifact." ], "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", "type": "path", "value": "/var/tmp/.s", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Reported payload, persistence or network artifact.", "role": "Reported payload, persistence or network artifact.", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context", "Reported payload, persistence or network artifact." ], "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95", "type": "path", "value": "/var/tmp/boom", "status": "reference_only", "source_ids": [ "watchtowr-repo" ], "source_urls": [ "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" ], "observations": [ { "status": "reference_only", "role": "PoC/example output marker; attribution and execution require corroboration", "confidence": "low", "description": "PoC/example output marker; attribution and execution require corroboration", "observation_category": "poc_marker", "source_ids": [ "watchtowr-repo" ], "source_urls": [ "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" ], "original_status": "reference_only", "source_dates": [ { "id": "watchtowr-repo", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "watchtowr-repo" ], "roles": [ "PoC/example output marker; attribution and execution require corroboration" ], "role": "PoC/example output marker; attribution and execution require corroboration", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b", "type": "path", "value": "/var/tmp/lula", "status": "reference_only", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "status": "reference_only", "role": "Community-reported payload, persistence or staging path; verify context", "confidence": "low", "description": "Community-reported payload, persistence or staging path; verify context", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "poppelgaard" ], "roles": [ "Community-reported payload, persistence or staging path; verify context" ], "role": "Community-reported payload, persistence or staging path; verify context", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9", "type": "path", "value": "/var/vpn/theme/x.php", "status": "reference_only", "source_ids": [ "technion" ], "source_urls": [ "https://github.com/technion/netscaler_scanner" ], "observations": [ { "status": "reference_only", "role": "Author-reported webshell path; text reference does not establish file existence", "confidence": "medium", "description": "Author-reported webshell path; text reference does not establish file existence", "source_ids": [ "technion" ], "source_urls": [ "https://github.com/technion/netscaler_scanner" ], "original_status": "reference_only", "source_dates": [ { "id": "technion", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "technion" ], "roles": [ "Author-reported webshell path; text reference does not establish file existence" ], "role": "Author-reported webshell path; text reference does not establish file existence", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b6be1d96-6a37-5350-bade-d162ede2dae5", "type": "path", "value": "/var/vpn/themes/logon.php", "status": "reference_only", "source_ids": [ "technion" ], "source_urls": [ "https://github.com/technion/netscaler_scanner" ], "observations": [ { "status": "reference_only", "role": "Author-reported webshell path; text reference does not establish file existence", "confidence": "medium", "description": "Author-reported webshell path; text reference does not establish file existence", "source_ids": [ "technion" ], "source_urls": [ "https://github.com/technion/netscaler_scanner" ], "original_status": "reference_only", "source_dates": [ { "id": "technion", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "technion" ], "roles": [ "Author-reported webshell path; text reference does not establish file existence" ], "role": "Author-reported webshell path; text reference does not establish file existence", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7", "type": "path", "value": "/vpn/media/e6ee7c85.ico", "status": "reference_only", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "status": "reference_only", "role": "webshell_request", "description": "Mandiant published example; filenames vary between victims.", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] } ], "source": [ "mandiant" ], "roles": [ "webshell_request" ], "role": "webshell_request", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e", "type": "path", "value": "/vpn/media/nsgclient.ico", "status": "reference_only", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "status": "reference_only", "description": "Hunting reference, not a local finding.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "published_artifact", "description": "published_artifact", "confidence": "published", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "original_status": "reference_only", "source_dates": [ { "id": "mandiant", "published": "2026-09-29", "retrieved": "2026-10-01" } ] } ], "source": [ "mandiant" ], "roles": [ "published_artifact", "reference_indicator" ], "role": "published_artifact; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", "type": "path", "value": "/vpn/scripts/linux/nsg64.deb", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_artifact", "description": "webshell_artifact", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": ".deb PHP webshell — RC4-encrypted C2 using key 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands via HTTP headers, cookies, GET/POST params. Supports cmd/size/dl/up/info commands. Uses /var/netscaler/.ns_suidcmd for privilege escalation. Source: Unit42 threat brief.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "287f7064-4981-41dc-977b-3d6801448747", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Secondary-source artifact; validate cited original report.", "webshell_artifact" ], "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", "type": "path", "value": "/vpn/scripts/linux/nsgclient18.deb", "status": "reference_only", "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "webshell_artifact", "description": "webshell_artifact", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": ".deb webshell in VPN client scripts directory — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Requested by multiple attacker IPs Sep 4-24 with daily VPS rotation. Source: Unit42 threat brief.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "31528ea2-29c1-4d3c-ac7b-ef2e5a4c753c", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "unit42" ], "roles": [ "Secondary-source artifact; validate cited original report.", "webshell_artifact" ], "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e", "type": "path", "value": "80974ca9.sig", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee", "type": "path", "value": "LoginIcon.sig", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66", "type": "path", "value": "e6ee7c85.sig", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "WHIPSHOT web shell variant — .sig extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 payloads from HTTP_NSC_CLIENTTYPE header, executes via eval(). Routes via AliasMatch from /vpn/media/e6ee7c85.ico. Source: Mandiant/GTIG.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "619c3c8a-e3b9-44e1-afd0-fec0abd60097", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd", "type": "path", "value": "nsginstaller.deb", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Lightweight PHP installer web shell — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 commands from HTTP_NSC_LDAP header, executes via shell_exec(). Modifies httpd.conf, sets SUID on /bin/sh, scrubs /etc/crontab, reboots via /netscaler/nsshutdown -R. Filenames vary (nginstaller, nginstaller2, etc.). Source: Mandiant/GTIG.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "e398d998-726f-46e0-8701-a4c514c5351e", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98", "type": "path", "value": "receiver.min.css", "status": "reference_only", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Webshell Apache Alias — attacker configures httpd.conf to route requests for non-existent receiver.min.css to .ctxs.receiver webshell. Check httpd.conf for 'Alias /logon/LogonPoint/custom/receiver.min.css'. Source: GreyNoise blog 2026-09-28.", "misp_type": "filename", "misp_to_ids": true, "attribute_uuid": "7f2b241e-5fa2-4ec9-a949-d95a28dec58a", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event" ], "roles": [ "Secondary-source artifact; validate cited original report." ], "role": "Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6", "type": "path", "value": "update_c08937.pl", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "description": "Investigation-derived artifact or routing path.", "role": "Investigation-derived artifact or routing path.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] } ], "source": [ "sygnia" ], "roles": [ "Investigation-derived artifact or routing path." ], "role": "Investigation-derived artifact or routing path.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", "type": "sha256", "value": "1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d", "status": "reference_only", "source_ids": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "payload_hash", "description": "Base64 payload text", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SHA-256 of Base64 payload from 3-stage CVE-2026-88771 exploit chain. Stage 1: dropper command in User-Agent → logged to httpaccess-vpn.log. Stage 2: login request poisons ns.log with 'pitboss PPE missed too many heartbeatsNSPPE;'. Stage 3: /netscaler/ns_monuploadd_err.pl processes poisoned log, extracts and executes command. Source: Unit42 threat brief.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "cc4e48ab-6198-4c1d-a4b0-e670a3e28c1a", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report.", "payload_hash" ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-afd36d04-8867-5378-888a-35110f025138", "type": "sha256", "value": "57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", "Published community webshell/payload hash aggregation" ], "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ; Published community webshell/payload hash aggregation", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", "type": "sha256", "value": "5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12", "status": "reference_only", "source_ids": [ "deyda-script", "esentire", "poppelgaard", "sygnia" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "status": "reference_only", "role": "SHA256 hash of webshell (.ico variant)", "description": "SHA256 hash of webshell (.ico variant)", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "description": "Suspicious investigation artifact hash.", "role": "Suspicious investigation artifact hash.", "confidence": "high", "status": "reference_only", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "original_status": "reference_only", "source_dates": [ { "id": "sygnia", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039387+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "esentire", "poppelgaard", "sygnia" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "SHA256 hash of webshell (.ico variant)", "Suspicious investigation artifact hash." ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.ico variant); Suspicious investigation artifact hash.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-56976039-ce98-5925-9da5-42f80fe3d742", "type": "sha256", "value": "6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7", "status": "reference_only", "source_ids": [ "deyda-script", "greynoise", "ifin-event", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "observations": [ { "status": "reference_only", "role": "webshell_hash", "description": "webshell_hash", "confidence": "published", "source_ids": [ "greynoise" ], "source_urls": [ "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" ], "original_status": "reference_only", "source_dates": [ { "id": "greynoise", "published": "2026-09-28", "retrieved": "2026-10-01T19:36:45.065290+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Webshell SHA-256 — GreyNoise-observed variant of .ctxs.receiver webshell. Different hash from Reddit-sourced sample (ed082f74...). Token redacted in GreyNoise post. Attacker playbook: chmod 6555 /bin/sh, install webshell, modify httpd.conf (Alias + AliasMatch + php_flag engine on), kill -HUP httpd. Source: GreyNoise blog 2026-09-28.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "b8870657-980e-4e2f-bd14-2d3d2ec0300e", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "greynoise", "ifin-event", "poppelgaard" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report.", "webshell_hash" ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; webshell_hash", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", "type": "sha256", "value": "73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "First payload returned from /xd7h/x. ", "role": "First payload returned from /xd7h/x. ", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "First payload returned from /xd7h/x. ", "Published community webshell/payload hash aggregation" ], "role": "First payload returned from /xd7h/x. ; Published community webshell/payload hash aggregation", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", "type": "sha256", "value": "79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186", "status": "reference_only", "source_ids": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "payload_hash", "description": "Decoded shell script", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SHA-256 of decoded shell script from 3-stage chain — deploys .ctxs.receiver webshell, patches httpd.conf (Alias/AliasMatch for receiver.min.css + hex variants), enables PHP engine, kill -HUP httpd. Source: Unit42 threat brief.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "709f0879-af79-4d79-a1d0-dccd855eac3d", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report.", "payload_hash" ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", "type": "sha256", "value": "7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774", "status": "reference_only", "source_ids": [ "deyda-script", "esentire", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "status": "reference_only", "role": "SHA256 hash of webshell (.deb variant)", "description": "SHA256 hash of webshell (.deb variant)", "confidence": "published", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "original_status": "reference_only", "source_dates": [ { "id": "esentire", "published": "2026-09-29", "retrieved": "2026-10-01T19:36:45.424617+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "esentire", "poppelgaard" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "SHA256 hash of webshell (.deb variant)" ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.deb variant)", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9612b66f-4245-59ae-9405-057c997c80a0", "type": "sha256", "value": "927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Platypus agent (shell script) retrieved from entretiensol[.]com", "role": "Platypus agent (shell script) retrieved from entretiensol[.]com", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Platypus agent (shell script) retrieved from entretiensol[.]com", "Published community webshell/payload hash aggregation" ], "role": "Platypus agent (shell script) retrieved from entretiensol[.]com; Published community webshell/payload hash aggregation", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", "type": "sha256", "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published hash for update_c08937.pl; no independently acquired sample.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "update_c08937.pl", "description": "update_c08937.pl", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SHA-256 of update_c08937.pl — Perl post-exploitation payload. Creates local account sec_monitor with superuser role in ns.conf, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz, uploads to 64.94.85.67:443, chmod 6555 /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal with httpd.conf AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and hex variants). Self-deletes after execution. Source: LevelBlue THOR team.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "7959b6fc-84f3-40e2-af66-790edcc1fe97", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Perl script update_c08937.pl ", "role": "Perl script update_c08937.pl ", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue", "poppelgaard" ], "roles": [ "Perl script update_c08937.pl ", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report.", "reference_indicator", "update_c08937.pl" ], "role": "Perl script update_c08937.pl ; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; reference_indicator; update_c08937.pl", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", "type": "sha256", "value": "9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab", "status": "reference_only", "source_ids": [ "arctic-wolf", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Perl script returned from /xd7h/nsmon.pl. ", "role": "Perl script returned from /xd7h/nsmon.pl. ", "confidence": "high", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "arctic-wolf", "poppelgaard" ], "roles": [ "Perl script returned from /xd7h/nsmon.pl. ", "Published community webshell/payload hash aggregation" ], "role": "Perl script returned from /xd7h/nsmon.pl. ; Published community webshell/payload hash aggregation", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", "type": "sha256", "value": "ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec", "status": "reference_only", "source_ids": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "status": "reference_only", "role": "payload_hash", "description": "nsg64.deb PHP webshell", "confidence": "published", "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "original_status": "reference_only", "source_dates": [ { "id": "unit42", "published": "2026-09-30", "retrieved": "2026-10-01T19:36:45.064965+00:00" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SHA-256 of nsg64.deb — .deb PHP webshell with RC4 C2. Key: 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands: cmd (shell_exec), size (wc -c), dl (file exfil), up (file write), info (PHP version). Uses /var/netscaler/.ns_suidcmd for privesc. Source: Unit42 threat brief.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "8dafb7e1-c580-41a2-b52a-0a685eec02ae", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "ifin-event", "poppelgaard", "unit42" ], "roles": [ "Community-repeated published webshell or payload hash", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report.", "payload_hash" ], "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", "type": "sha256", "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published hash for main.py; no independently acquired sample.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "main.py", "description": "main.py", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "SHA-256 of main.py — Python reverse-shell payload. Overwrites /var/python/bin/customsnmpd with code that connects to 45.141.21.130:443, redirects stdin/stdout/stderr to socket, launches /bin/sh. Also kills existing customsnmpd processes. Source: LevelBlue THOR team.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "eac3991b-e3a0-4335-8180-a32bddf999e7", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Secondary-source artifact; validate cited original report.", "main.py", "reference_indicator" ], "role": "Secondary-source artifact; validate cited original report.; main.py; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", "type": "sha256", "value": "ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1", "status": "reference_only", "source_ids": [ "deyda-script", "ifin-event", "poppelgaard", "rapid7" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "observations": [ { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "PHP webshell .ctxs.receiver — backdoor on NetScaler LogonPoint. passthru(urldecode($_COOKIE[\"NSC_TASS\"])) triggered by CsrfToken cookie match. 237 bytes. Token likely varies per victim — grep for content pattern, not just hash. Source: Reddit user K7Fy6fWmTv76D3qAPn via Discourse post #6.", "misp_type": "sha256", "misp_to_ids": true, "attribute_uuid": "7d28869f-a134-4b95-9ed2-735c7866a52f", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Hidden PHP webshell hash.", "role": "Hidden PHP webshell hash.", "confidence": "high", "status": "reference_only", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "original_status": "reference_only", "source_dates": [ { "id": "rapid7", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039385+00:00" } ] }, { "status": "reference_only", "role": "Published community webshell/payload hash aggregation", "confidence": "low", "description": "Published community webshell/payload hash aggregation", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "original_status": "reference_only", "source_dates": [ { "id": "poppelgaard", "published": null, "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Community-repeated published webshell or payload hash", "confidence": "low", "description": "Community-repeated published webshell or payload hash", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "original_status": "reference_only", "source_dates": [ { "id": "deyda-script", "published": null, "retrieved": "2026-10-01" } ] } ], "source": [ "deyda-script", "ifin-event", "poppelgaard", "rapid7" ], "roles": [ "Community-repeated published webshell or payload hash", "Hidden PHP webshell hash.", "Published community webshell/payload hash aggregation", "Secondary-source artifact; validate cited original report." ], "role": "Community-repeated published webshell or payload hash; Hidden PHP webshell hash.; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6ac8fcee-0ae5-52e9-b3e0-e5b3b0f9313f", "type": "sha256", "value": "53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a9d5f5c9-336e-5f2d-bfb5-db7b373a8a35", "type": "sha256", "value": "62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-135b9d7d-6619-5cee-ba16-548196e71999", "type": "sha256", "value": "8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-52059bbe-4c5d-5494-8b87-c91252d67c65", "type": "sha256", "value": "81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a9cb81f2-189f-56c5-9e51-e5dba0618386", "type": "sha256", "value": "ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-9976f53c-b6bf-5aa7-bd36-40565777f617", "type": "sha256", "value": "b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-849554d4-80a5-51bf-933f-d597aa130138", "type": "sha256", "value": "e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-78aac967-820a-59f8-9dd7-99a5511de4e3", "type": "sha256", "value": "e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-8b74a63c-e8d2-5f86-8fc0-b2d8b2a2a81d", "type": "sha256", "value": "ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b", "status": "reference_only", "provenance": "unattributed_public_indicator", "source_ids": [], "source_urls": [], "observations": [ { "status": "reference_only", "original_status": "reference_only", "role": "search_candidate", "confidence": "low", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "source_ids": [], "source_urls": [], "source_dates": [] } ], "source": [], "roles": [ "search_candidate" ], "role": "search_candidate", "description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3", "type": "url", "value": "http://134.175.71.50:4123/1", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://134.175.71[.]50:4123/1", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-49be21fd-6b54-51f3-8ab5-6c4b65bcd3a6", "type": "url", "value": "http://153.75.82.220/download/x.sh", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://153.75.82[.]220/download/x.sh", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-48342f6c-9687-5227-9482-717ab428c77c", "type": "url", "value": "http://177.4.12.11:8080/s?t=a", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://177.4.12[.]11:8080/s?t=a", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-59dd2664-9887-539e-bc3a-b8972625933a", "type": "url", "value": "http://177.4.12.11:8080/s?t=b", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://177.4.12[.]11:8080/s?t=b", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f3832e49-bc15-5a17-a33a-d18bcebaf835", "type": "url", "value": "http://177.4.12.11:8080/s?t=c", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://177.4.12[.]11:8080/s?t=c", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", "type": "url", "value": "http://23.27.143.20:9000/main.py", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published endpoint; do not contact it.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Python reverse-shell payload", "description": "Python reverse-shell payload", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Python reverse-shell payload — overwrites /var/python/bin/customsnmpd with code connecting to 45.141.21.130:443. Source: LevelBlue THOR team.", "misp_type": "url", "misp_to_ids": true, "attribute_uuid": "daacdefc-6b6a-483e-885d-002f64346944", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "medium", "status": "reference_only", "original_value": "hxxp:/23.27.143[.]20:9000/main.py", "normalization_inferred": true, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue" ], "roles": [ "Payload retrieval or execution-check resource.", "Python reverse-shell payload", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Payload retrieval or execution-check resource.; Python reverse-shell payload; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-fb0b6f32-e20b-516a-951b-69158d6910a7", "type": "url", "value": "http://31.56.197.72/kk", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://31.56.197[.]72/kk", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-01772fb3-a35a-5447-8d2c-7a4665bcea56", "type": "url", "value": "http://31.56.197.72/lula", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://31.56.197[.]72/lula", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", "type": "url", "value": "http://31.56.197.72:9090/lula", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published endpoint; do not contact it.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload download URL", "description": "Payload download URL", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", "misp_type": "url", "misp_to_ids": true, "attribute_uuid": "510806c9-df51-4b1f-b985-d2b469471b7c", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://31.56.197[.]72:9090/lula", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue" ], "roles": [ "Payload download URL", "Payload retrieval or execution-check resource.", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-3c8206c9-a9db-5cdc-9a56-2b845387e628", "type": "url", "value": "http://62.133.62.80:80/xd7h/nsmon.pl", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://62.133.62[.]80:80/xd7h/nsmon.pl", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", "type": "url", "value": "http://62.133.62.80:80/xd7h/x", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published endpoint; do not contact it.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Payload download URL", "description": "Payload download URL", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", "misp_type": "url", "misp_to_ids": true, "attribute_uuid": "b81cc60d-d93f-4c6d-8fb7-fb32a71a2fff", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://62.133.62[.]80:80/xd7h/x", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue" ], "roles": [ "Payload download URL", "Payload retrieval or execution-check resource.", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", "type": "url", "value": "http://64.94.85.67:443/update_c08937.pl", "status": "reference_only", "source_ids": [ "arctic-wolf", "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published endpoint; do not contact it.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Perl post-exploitation payload", "description": "Perl post-exploitation payload", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Perl post-exploitation payload — creates sec_monitor account with superuser role, chmod 6555 /bin/sh, deploys .local_journal webshell, exfiltrates /flash/nsconfig. Piped directly to perl. Source: LevelBlue THOR team.", "misp_type": "url", "misp_to_ids": true, "attribute_uuid": "d56c3308-357e-4afc-9a60-bb3159c70497", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] }, { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://64.94.85[.]67:443/update_c08937.pl", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf", "ifin-event", "levelblue" ], "roles": [ "Payload retrieval or execution-check resource.", "Perl post-exploitation payload", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Payload retrieval or execution-check resource.; Perl post-exploitation payload; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", "type": "url", "value": "http://64.94.85.67:443/update_result_3567cs.tgz", "status": "reference_only", "source_ids": [ "ifin-event", "levelblue" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "status": "reference_only", "description": "Published endpoint; do not contact it.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "status": "reference_only", "role": "Configuration exfiltration endpoint", "description": "Configuration exfiltration endpoint", "confidence": "published", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "original_status": "reference_only", "source_dates": [ { "id": "levelblue", "published": "2026-09-30", "retrieved": "2026-10-01" } ] }, { "description": "Secondary-source artifact; validate cited original report.", "role": "Secondary-source artifact; validate cited original report.", "confidence": "low", "status": "reference_only", "original_comment": "Configuration exfiltration endpoint — upload target for archived /flash/nsconfig data. Source: LevelBlue THOR team.", "misp_type": "url", "misp_to_ids": true, "attribute_uuid": "2626a32d-8681-41ba-9c7c-92b04c345976", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "original_status": "reference_only", "source_dates": [ { "id": "ifin-event", "published": "2026-09-28", "retrieved": "2026-10-01T19:44:37.039091+00:00" } ] } ], "source": [ "ifin-event", "levelblue" ], "roles": [ "Configuration exfiltration endpoint", "Secondary-source artifact; validate cited original report.", "reference_indicator" ], "role": "Configuration exfiltration endpoint; Secondary-source artifact; validate cited original report.; reference_indicator", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-f641d7d2-2d09-5490-8a90-d24e12541532", "type": "url", "value": "http://68.178.160.183:8888/test", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://68.178.160[.]183:8888/test", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-a72639b6-e8bd-5954-bc27-e56981f25122", "type": "url", "value": "http://68.178.160.183:8899/test111", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://68.178.160[.]183:8899/test111", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false }, { "id": "ioc-e1cab8ac-c435-58ec-a680-0b71d0f945dd", "type": "url", "value": "http://89.44.80.7:65456/exec-ok", "status": "reference_only", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "description": "Payload retrieval or execution-check resource.", "role": "Payload retrieval or execution-check resource.", "confidence": "high", "status": "reference_only", "original_value": "hxxp://89.44.80[.]7:65456/exec-ok", "normalization_inferred": false, "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "original_status": "reference_only", "source_dates": [ { "id": "arctic-wolf", "published": "2026-09-30", "retrieved": "2026-10-01T19:44:37.039386+00:00" } ] } ], "source": [ "arctic-wolf" ], "roles": [ "Payload retrieval or execution-check resource." ], "role": "Payload retrieval or execution-check resource.", "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", "matching": "exact", "context_only": false } ], "patterns": [ { "id": "log_poisoning", "sigma_rule_id": "db5aa260-5141-5e4b-91a4-a7883d81a9a4", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)pitboss.*(?:NSPPE|PPE).*(?:unexpectedly died|missed too many heartbeats).*?(?:[;`|]|\\$\\{)", "description": "Process-monitor text contains shell metacharacters; inspect for log poisoning or injected command text. This does not prove execution.", "source": [], "source_ids": [], "source_urls": [], "observations": [] }, { "id": "engine_crash", "sigma_rule_id": "0390ae7b-c88e-5b57-afa4-dc2575ee1d66", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)(?:^|\\s)pitboss(?:\\[\\d+\\])?:.*(?:NOT restarting|core dumped|unexpectedly died)|qat\\d+:.*orphan rings", "description": "A process or accelerator failure is logged. Correlate with requests and restart records; a crash alone does not establish exploitation.", "source": [], "source_ids": [], "source_urls": [], "observations": [] }, { "id": "dtls_error", "sigma_rule_id": "5cb2d3c3-bb26-581e-be5a-3594b3aec4f7", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)DTLSv1\\.0.*handshake failure.internal error", "description": "A DTLS handshake internal error is present. This is a diagnostic signal, not proof of a successful attack.", "source": [], "source_ids": [], "source_urls": [], "observations": [] }, { "id": "command_injection", "sigma_rule_id": "2f64329b-edfa-5d35-9711-186f4860e6ef", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)(?:curl|wget)\\s.*(?:https?://|\\$\\{IFS\\})|b64decode|\\$\\{IFS\\}|(?:;|`)(?:id|hostname|sleep)\\b|/(?:vpn|logon)/[^\\s?\"<>]*\\.php\\?(?:0|x|cmd|exec|command)=(?:echo[ \\t]+[^\\r\\n&;|<>]{1,128}|id|date)(?:[ \\t]*&&[ \\t]*(?:date|id))*(?:[ \\t]*$|[ \\t]*[)\"<>]|[ \\t]+HTTP/)", "description": "Command-download or injection syntax, including diagnostic command probes against PHP routes under /vpn/ or /logon/. Requests, blocked probes and authorized testing are not evidence of execution.", "source": [], "source_ids": [], "source_urls": [], "observations": [], "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." }, { "id": "php_execution", "sigma_rule_id": "85769f76-e95b-5b33-bb3f-295709f4eaf3", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)<\\?php|(?:passthru|shell_exec|base64_decode)\\s*\\(", "description": "PHP source or execution/decoding functions appear in the text. Inspect the complete payload and file evidence; a text match does not establish server-side execution.", "source": [], "source_ids": [], "source_urls": [], "observations": [] }, { "id": "privilege_persistence", "sigma_rule_id": "9d719506-517e-50fb-9675-48d2907c8733", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)chmod\\s+(?:[467][0-7]{3}|u\\+s).*?/bin/sh|AddHandler.*php|AliasMatch|authorized_keys|add system user", "description": "The text references permission changes, executable web handlers, SSH keys, or account creation. Verify authorization and actual state changes before attributing persistence.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_suid_shell", "description": "Sets privileged shell permissions.", "caveat": "Actual execution/filesystem state is stronger than command appearing in an injected username.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_suid_shell" } ] }, { "id": "traversal", "sigma_rule_id": "e39745df-f20d-5ecb-831a-1c848b265a4d", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)/(?:vpn|vpns)/\\.\\./|/etc/passwd|/\\.git/|/\\.env(?:\\s|\\?)|Path traversal detected[ \\t]*\\|/|/cgi-bin/(?:\\.\\./)+", "description": "The text references traversal syntax or commonly probed sensitive paths. Check response content and related events; the request alone does not prove disclosure.", "source": [], "source_ids": [], "source_urls": [], "observations": [] }, { "id": "encoded_user_agent", "sigma_rule_id": "d90f1337-428b-5156-adaf-3cba3906c11c", "origin": { "provenance_type": "locally_authored_generic_heuristic", "scope_not_campaign_specific": true, "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." }, "pattern": "(?i)(?:\"(?:INDEX|[A-Za-z0-9]{1,12}):[A-Za-z0-9+/]{32,}={0,2}\"|User-Agent[^\\r\\n]*(?:INDEX|C2|3P|4B):?[A-Za-z0-9+/]{40,})", "description": "A quoted marker and Base64-shaped value were found. Review bounded decoding results; this pattern alone does not establish a malicious payload.", "source": [ "cert-eu", "unit42" ], "source_ids": [ "cert-eu", "unit42" ], "source_urls": [ "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "id": "cert_staged_index", "description": "Base64 staging marker in HTTP User-Agent.", "caveat": "Decode offline; marker alone is staging, not execution.", "correlation": null, "source_ids": [ "cert-eu" ], "source_urls": [ "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" ], "matching": "pattern", "mapped_from": "cert_staged_index" }, { "id": "unit42_variable_stage_marker", "description": "Observed short staging prefixes vary; candidate must occur in User-Agent and decode to code.", "caveat": "Low-specificity without HTTP field context; do not match arbitrary text alone.", "correlation": null, "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "matching": "pattern", "mapped_from": "unit42_variable_stage_marker" } ] }, { "id": "ti_dtls_internal_error", "sigma_rule_id": "f2b2bc2b-d781-56e6-a464-5731efb85c10", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)SSL_HANDSHAKE_FAILURE.*DTLSv1\\.0.*Handshake failure-Internal Error", "description": "DTLS error; insufficient on its own to establish code execution.", "source": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_ids": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_dtls_crash", "description": "DTLS failure associated with observed exploitation.", "caveat": "An isolated handshake failure is not conclusive.", "correlation": "Correlate qat orphan rings and NSPPE pitboss termination on same appliance in a short interval.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_dtls_crash" }, { "id": "certfr_dtls_handshake", "description": "Joint DTLS/cipher/internal-error log pattern; contextual lead, not standalone success verdict.", "status": "reference_only", "published": "2026-09-30", "retrieved": "2026-10-01", "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", "source_ids": [ "CERTFR-2026-ALE-011" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" ], "matching": "pattern", "mapped_from": "certfr_dtls_handshake" } ] }, { "id": "ti_nsppe_orphan", "sigma_rule_id": "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)NSPPE-\\d+.*exit with orphan rings", "description": "Process termination indicator.", "source": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_ids": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_qat_orphans", "description": "NSPPE abnormal exit signal paired with DTLS failure.", "caveat": "Crashes have benign causes.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_qat_orphans" }, { "id": "certfr_nsppe_orphan", "description": "Packet-engine orphan-ring message; correlate with nearby restart suppression and other evidence.", "status": "reference_only", "published": "2026-09-30", "retrieved": "2026-10-01", "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", "source_ids": [ "CERTFR-2026-ALE-011" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" ], "matching": "pattern", "mapped_from": "certfr_nsppe_orphan" } ] }, { "id": "ti_nsppe_not_restart", "sigma_rule_id": "35bc541e-25f4-5d4b-80e4-b22f2e9ff801", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)pitboss.*NOT restarting NSPPE", "description": "Indicator that a process was not restarted.", "source": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_ids": [ "CERTFR-2026-ALE-011", "mandiant" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "certfr_pitboss_restart", "description": "Restart suppression message; preserve PID/device/time and correlate, allowing benign crash context.", "status": "reference_only", "published": "2026-09-30", "retrieved": "2026-10-01", "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", "source_ids": [ "CERTFR-2026-ALE-011" ], "source_urls": [ "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" ], "matching": "pattern", "mapped_from": "certfr_pitboss_restart" } ] }, { "id": "ti_shell_headers", "sigma_rule_id": "f2336666-9fca-5688-93b7-bf4fa85e082e", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)(?:HTTP_)?(?:NSC[-_]LDAP|NSC[-_]CLIENTTYPE|X[-_]UX(?:[-_]\\d+)?)", "description": "Header hunting pattern.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_header_transport", "description": "Header channels used by reported PHP implants.", "caveat": "Header name is contextual; require encoded payload, suspicious route or implant evidence.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_header_transport" } ] }, { "id": "ti_php_handler", "sigma_rule_id": "2fe32158-28e3-5512-8640-f713c7f6d2c0", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)Add(?:Handler|Type)\\s+[^\\r\\n]*application/x-httpd-php(?:-source)?\\s+(?:\\.[A-Za-z0-9]+[ \\t]+)*\\.(?:deb|sig|ico|css|js|png|gif|jpg)\\b", "description": "PHP handler mapped to a non-PHP artifact extension such as .deb or .sig. Ordinary .php/.phps mappings alone do not match; verify whether this is a requested change or an actual configuration change.", "source": [ "mandiant", "sygnia" ], "source_ids": [ "mandiant", "sygnia" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "id": "mandiant_nonphp_handler", "description": "PHP handler registration for non-PHP extension.", "caveat": "Validate appliance configuration baseline.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_nonphp_handler" }, { "id": "sygnia-php-handlers", "description": "PHP handler mapping for disguised file extensions.", "status": "experimental", "confidence": "medium", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "matching": "pattern", "mapped_from": "sygnia-php-handlers" } ], "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." }, { "id": "ti_staged_webshell", "sigma_rule_id": "3aa3db2c-e2c7-583d-9203-e96833e5b5c2", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)/vpn/scripts/linux/(?:nsginstaller[^\\s/?]*\\.deb|nsgclient[^\\s/?]*\\.(?:deb|sig)|[^\\s/?]+\\.php)", "description": "Path pattern for webshell hunting.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_staging_paths", "description": "Published staging path patterns; .deb directory also contains legitimate packages.", "caveat": "Review context and actual execution separately.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_staging_paths" } ] }, { "id": "ti_log_poisoning", "sigma_rule_id": "3ec17436-eb51-5768-9b72-aece3b7d907a", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)pitboss[^\\r\\n]*(?:NSPPE|PPE)[^\\r\\n]*(?:;|`|\\$\\{?IFS\\}?|%3b|%60|%24%28)", "description": "Potentially manipulated text; establish subsequent processing independently.", "source": [ "cert-eu", "sygnia", "watchtowr", "watchtowr-repo" ], "source_ids": [ "cert-eu", "sygnia", "watchtowr", "watchtowr-repo" ], "source_urls": [ "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "id": "cert_log_poisoning", "description": "Authentication data imitates a crash line and appends commands.", "caveat": "Failed authentication does not rule out later execution.", "correlation": "Same appliance: staged access-log marker, poisoned auth event, ns_monuploadd_err.pl invocation, then side effects.", "source_ids": [ "cert-eu" ], "source_urls": [ "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" ], "matching": "pattern", "mapped_from": "cert_log_poisoning" }, { "id": "sygnia-pitboss-command", "description": "Crash-like authentication text with command delimiter; injection attempt, not proof of execution.", "status": "experimental", "confidence": "medium", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "matching": "pattern", "mapped_from": "sygnia-pitboss-command" }, { "id": "watchtowr_crash_injection", "description": "Crash-like text followed by command syntax, including the public artifact-generator form.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "watchtowr", "watchtowr-repo" ], "source_urls": [ "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" ], "matching": "pattern", "mapped_from": "watchtowr_crash_injection" } ] }, { "id": "ti_delayed_processor", "sigma_rule_id": "324d542c-d00d-5ee9-be43-7f6e44d30afa", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)ns_monuploadd_err\\.pl", "description": "Indicator of possible subsequent processing.", "source": [ "watchtowr" ], "source_ids": [ "watchtowr" ], "source_urls": [ "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" ], "observations": [] }, { "id": "ti_css_journal", "sigma_rule_id": "db27552c-3c30-5a99-9e82-7ec76c7ba3cd", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)LogonUISimple\\.html\\.style(?:\\.[a-f0-9]+)?\\.min\\.css|\\.local_journal", "description": "CSS disguise and journal artifact pattern.", "source": [ "levelblue" ], "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "id": "levelblue_local_journal_alias", "description": "Reported .local_journal masquerading route.", "caveat": "CSS names may overlap legitimate assets; require PHP alias/content corroboration.", "correlation": null, "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "matching": "pattern", "mapped_from": "levelblue_local_journal_alias" } ] }, { "id": "unit42_cookie_execution", "sigma_rule_id": "623305d2-16b6-5710-adc8-b762522af1be", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is)(?:CsrfToken.*NSC_TASS|NSC_TASS.*CsrfToken)", "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", "source": [ "unit42" ], "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "id": "unit42_cookie_execution", "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", "caveat": "Legitimate cookie names alone are insufficient; decode value and examine destination/response.", "correlation": null, "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "matching": "pattern", "mapped_from": "unit42_cookie_execution" } ] }, { "id": "unit42_receiver_alias", "sigma_rule_id": "48774954-8559-562c-902a-2ba8a75f2e2c", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)/logon/LogonPoint/custom/receiver\\.min(?:\\.[0-9a-f]+)?\\.css", "description": "CSS-disguised webshell route.", "source": [ "ifin-event", "unit42" ], "source_ids": [ "ifin-event", "unit42" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "id": "unit42_receiver_alias", "description": "CSS-disguised webshell route.", "caveat": "Confirm alias or shell content; request alone does not prove execution.", "correlation": null, "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "matching": "pattern", "mapped_from": "unit42_receiver_alias" }, { "id": "ifin-css-hex-alias", "description": "Community-reported alias pattern; verify context.", "status": "experimental", "confidence": "medium", "source_ids": [ "ifin-event" ], "source_urls": [ "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" ], "matching": "pattern", "mapped_from": "ifin-css-hex-alias" } ] }, { "id": "unit42_anomalous_getusername", "sigma_rule_id": "31940357-e53f-57f8-b908-9599b0913fd2", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "/logon/LogonPoint/Authentication/GetUserName", "description": "Repeated pre-disclosure activity to anomalous endpoint.", "source": [ "unit42" ], "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "observations": [ { "id": "unit42_anomalous_getusername", "description": "Repeated pre-disclosure activity to anomalous endpoint.", "caveat": "Investigative signal; no standalone exploitation conclusion.", "correlation": null, "source_ids": [ "unit42" ], "source_urls": [ "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" ], "matching": "pattern", "mapped_from": "unit42_anomalous_getusername" } ] }, { "id": "mandiant_slapshot_launch", "sigma_rule_id": "86c468d2-0afc-5eb2-9070-62a4d0f0ba42", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is)nohup\\s+python.*base64.*\\.uxdport.*\\.uxdlock", "description": "Detached encoded Python tunneler launch with hidden IPC files.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_slapshot_launch", "description": "Detached encoded Python tunneler launch with hidden IPC files.", "caveat": "Do not execute the decoded code.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_slapshot_launch" } ] }, { "id": "mandiant_fato_webshell", "sigma_rule_id": "5614e015-a1e0-5c80-bce4-f20f3e689a50", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is).*", "description": "PHP implant framing markers.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_fato_webshell", "description": "PHP implant framing markers.", "caveat": "Combine with NSC header parsing and dynamic execution; markup alone insufficient.", "correlation": null, "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_fato_webshell" } ] }, { "id": "esentire_php_useragent", "sigma_rule_id": "a5f6d8e8-e170-5aae-a7a2-710beac8ee28", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)/vpn/media/[^\\s\"?]+\\.ico.*PD9[A-Za-z0-9+/]{20,}", "description": "Icon request followed by encoded PHP staging in User-Agent.", "source": [ "esentire" ], "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "observations": [ { "id": "esentire_php_useragent", "description": "Icon request followed by encoded PHP staging in User-Agent.", "caveat": "HTTP404 is expected for both unsuccessful staging and active stealth webshell responses.", "correlation": "Correlate poisoned auth event, script invocation, changed handlers/files and outbound/lateral traffic.", "source_ids": [ "esentire" ], "source_urls": [ "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" ], "matching": "pattern", "mapped_from": "esentire_php_useragent" } ] }, { "id": "levelblue_backtick_poisoning", "sigma_rule_id": "11c3813f-894b-51f6-80fb-d7dab0c0e8dd", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)pitboss.*NSPPE.*`.*(?:tar|curl|wget|cat).*`.*unexpectedly died", "description": "Backtick substitution variant can avoid semicolon-only detections.", "source": [ "levelblue" ], "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "id": "levelblue_backtick_poisoning", "description": "Backtick substitution variant can avoid semicolon-only detections.", "caveat": "", "correlation": null, "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "matching": "pattern", "mapped_from": "levelblue_backtick_poisoning" } ] }, { "id": "levelblue_config_staging", "sigma_rule_id": "5907a6d1-0c74-5eae-9e9b-588c0bab859d", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is)(?:cat|cp|tar).*?/flash/nsconfig.*(?:>|/var/netscaler/logon)|(?:tar|cat).*?/var/netscaler/logon.*?/flash/nsconfig", "description": "Copies or archives configuration into web-accessible files.", "source": [ "levelblue" ], "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "observations": [ { "id": "levelblue_config_staging", "description": "Copies or archives configuration into web-accessible files.", "caveat": "Validate command execution and HTTP retrieval or network exfiltration.", "correlation": null, "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "matching": "pattern", "mapped_from": "levelblue_config_staging" } ] }, { "id": "mandiant_icon_route", "sigma_rule_id": "052a9870-fe4b-5b43-8261-5e523636590b", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)AliasMatch.*?/vpn/media/.*?/var/netscaler/gui/vpn/scripts/linux/.*?\\.sig", "description": "Icon-to-signature PHP routing persistence.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_icon_route", "description": "Icon-to-signature PHP routing persistence.", "caveat": "Review context and actual execution separately.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_icon_route" } ] }, { "id": "mandiant_php_execution", "sigma_rule_id": "79c6ea05-8efd-51b4-8fd2-79613054863d", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is)(?:HTTP_)?NSC_(?:LDAP|CLIENTTYPE|USER|NONCE|FT_HIDE).*?(?:eval|shell_exec|passthru|system).*?base64_decode", "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", "source": [ "mandiant" ], "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "observations": [ { "id": "mandiant_php_execution", "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", "caveat": "Review context and actual execution separately.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "matching": "pattern", "mapped_from": "mandiant_php_execution" } ] }, { "id": "aw-resource-prefix-1", "sigma_rule_id": "985490ff-cbe4-50e7-b4a9-f962543255af", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "http://89\\.44\\.80\\.7:65456/", "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", "source": [ "arctic-wolf" ], "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "id": "aw-resource-prefix-1", "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", "status": "experimental", "confidence": "medium", "original_value": "hxxp://89.44.80[.]7:65456/$(id|base64 -w0)", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "matching": "pattern", "mapped_from": "aw-resource-prefix-1" } ] }, { "id": "aw-resource-prefix-2", "sigma_rule_id": "7ff4a684-f5e1-50b6-b543-ba30ae52818c", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "http://130\\.94\\.42\\.226:18805/\\?t=", "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", "source": [ "arctic-wolf" ], "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "id": "aw-resource-prefix-2", "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", "status": "experimental", "confidence": "medium", "original_value": "hxxp://130.94.42[.]226:18805/?t=", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "matching": "pattern", "mapped_from": "aw-resource-prefix-2" } ] }, { "id": "aw-nsmon-cron", "sigma_rule_id": "6bb4bd57-96bf-5bf5-b2b2-36ce721d4902", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)\\*/5\\s+\\*\\s+\\*\\s+\\*\\s+\\*\\s+root\\s+perl\\s+/var/tmp/\\.nsmon/nsmon\\.pl", "description": "Root cron invokes reported hidden Perl implant every five minutes.", "source": [ "arctic-wolf" ], "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "id": "aw-nsmon-cron", "description": "Root cron invokes reported hidden Perl implant every five minutes.", "status": "experimental", "confidence": "medium", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "matching": "pattern", "mapped_from": "aw-nsmon-cron" } ] }, { "id": "aw-encoded-command-output", "sigma_rule_id": "7f6eb722-0be4-581f-bed5-10d8d3b26247", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)\\bid\\s*\\|\\s*base64\\s+-w\\s*0", "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", "source": [ "arctic-wolf" ], "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "id": "aw-encoded-command-output", "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", "status": "experimental", "confidence": "medium", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "matching": "pattern", "mapped_from": "aw-encoded-command-output" } ] }, { "id": "rapid7-tar-config", "sigma_rule_id": "156c151e-13b0-5dd7-a22c-07bdb4af9327", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)\\btar(?:\\$\\{?IFS\\}?|\\s)+czf.*?/var/netscaler/gui/vpn/c\\b.*?(?:/flash|nsconfig)", "description": "Configuration archive staged under web root; command presence is not proof of execution.", "source": [ "rapid7" ], "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "observations": [ { "id": "rapid7-tar-config", "description": "Configuration archive staged under web root; command presence is not proof of execution.", "status": "experimental", "confidence": "medium", "original_command": "tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig", "normalized_command": "tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig", "source_ids": [ "rapid7" ], "source_urls": [ "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" ], "matching": "pattern", "mapped_from": "rapid7-tar-config" } ] }, { "id": "sygnia-encoded-loader", "sigma_rule_id": "9fb8bb55-fb55-535a-9b4c-6344f8b08bfe", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?im)^(?=.*(?:pitboss|NSPPE))(?=.*(?:base64|PD9))(?=.*(?:2N|httpaccess))", "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", "source": [ "sygnia" ], "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "observations": [ { "id": "sygnia-encoded-loader", "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", "status": "experimental", "confidence": "medium", "source_ids": [ "sygnia" ], "source_urls": [ "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" ], "matching": "pattern", "mapped_from": "sygnia-encoded-loader" } ] }, { "id": "elastic-inspired-crash-shell", "sigma_rule_id": "a0f728c2-6c21-50e7-9909-ae5df3b77538", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?im)^(?=.*pitboss)(?:(?=.*(?:nsppe|\\bppe\\b|core))|(?=(?>.*?packet).*engine))(?=.*(?:;|`|\\$\\(|&&|\\|\\||%3b|%60|%7c|%24%28|%26%26|%3e|%3c))", "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", "source": [ "elastic-toml" ], "source_ids": [ "elastic-toml" ], "source_urls": [ "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" ], "observations": [ { "id": "elastic-inspired-crash-shell", "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", "status": "experimental", "confidence": "medium", "license_note": "Original Elastic License v2; source rule not copied into product.", "source_ids": [ "elastic-toml" ], "source_urls": [ "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" ], "matching": "pattern", "mapped_from": "elastic-inspired-crash-shell" } ] }, { "id": "aw-platypus-install-prefix", "sigma_rule_id": "0a8f1d34-83bb-5ade-bfc8-1bd45f221a27", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "https://entretiensol\\.com:443/api/v1/install/", "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", "source": [ "arctic-wolf" ], "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "observations": [ { "id": "aw-platypus-install-prefix", "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", "status": "experimental", "confidence": "medium", "original_value": "hxxps://entretiensol[.]com:443/api/v1/install/", "source_ids": [ "arctic-wolf" ], "source_urls": [ "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" ], "matching": "pattern", "mapped_from": "aw-platypus-install-prefix" } ] }, { "id": "historical_startup_obfuscation", "sigma_rule_id": "742a1576-1923-58ce-801a-813820e41169", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)fnoc\\.dptth|php\\.(?:xedni|xednimt|IUnogoL)|hs/pmt/rav/|tnioPnogoL|gifnocsn|relacsten\\.cr", "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", "source": [ "deyda-script", "ncsc-nl-2025" ], "source_ids": [ "deyda-script", "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "observations": [ { "id": "historical_startup_obfuscation", "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "deyda-script", "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "matching": "pattern", "mapped_from": "historical_startup_obfuscation" } ] }, { "id": "php_input_execution", "sigma_rule_id": "3fafb627-665f-5caa-9a4b-229086449433", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?is)<\\?(?:php)?[^\\r\\n]*(?:eval\\s*\\(\\s*\\$_|(?:base64_decode|passthru|shell_exec|array_filter)\\s*\\()", "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", "source": [ "fox-it", "ncsc-nl-2025" ], "source_ids": [ "fox-it", "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025", "https://github.com/fox-it/citrix-netscaler-triage" ], "observations": [ { "id": "php_input_execution", "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "fox-it", "ncsc-nl-2025" ], "source_urls": [ "https://github.com/NCSC-NL/citrix-2025", "https://github.com/fox-it/citrix-netscaler-triage" ], "matching": "pattern", "mapped_from": "php_input_execution" } ] }, { "id": "persistence_target_write", "sigma_rule_id": "b72b1566-d05a-5fca-8cb4-229fcb59cc95", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)(?:\\b(?:echo|printf|cp|mv|sed|tee)\\b[^\\r\\n]*)(?:rc\\.netscaler|nsafter\\.sh|/etc/rc\\.conf\\.defaults)", "description": "Command text writes or edits startup targets; compare approved configuration.", "source": [ "deyda-script", "poppelgaard" ], "source_ids": [ "deyda-script", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "observations": [ { "id": "persistence_target_write", "description": "Command text writes or edits startup targets; compare approved configuration.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "deyda-script", "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "matching": "pattern", "mapped_from": "persistence_target_write" } ] }, { "id": "setuid_temporary_shell", "sigma_rule_id": "67e7c3f5-d648-516e-97fc-79ceb36453fb", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)chmod\\s+(?:[ugoa]*\\+s|[4567][0-7]{3})\\s+(?:/var/tmp/sh|/bin/sh)", "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", "source": [ "deyda-script" ], "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "observations": [ { "id": "setuid_temporary_shell", "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "deyda-script" ], "source_urls": [ "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" ], "matching": "pattern", "mapped_from": "setuid_temporary_shell" } ] }, { "id": "trace_removal", "sigma_rule_id": "5fbd05f0-df10-513d-acfc-e856fa90dd70", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)(?:\\brm\\s+(?:-[A-Za-z]+\\s+)*|\\btruncate\\s+[^\\r\\n]*|/dev/null\\s*>\\s*)(?:/var/(?:log|nslog|core)/|[^\\r\\n]*\\.log\\b)", "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", "source": [ "poppelgaard" ], "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "id": "trace_removal", "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "matching": "pattern", "mapped_from": "trace_removal" } ] }, { "id": "community_credential_access", "sigma_rule_id": "83dd2ce5-c181-534b-b8b4-0b58dd9501d5", "origin": { "provenance_type": "public_source_informed_heuristic", "scope_not_campaign_specific": false, "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." }, "pattern": "(?i)(?:\\b(?:cat|cp|tar|openssl|ldapsearch)\\b[^\\r\\n]*)(?:/flash/nsconfig/keys|F[12]\\.key|database\\.php|LDAPTLS_REQCERT)", "description": "Credential/key access command context; legitimate administration can match.", "source": [ "poppelgaard" ], "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "observations": [ { "id": "community_credential_access", "description": "Credential/key access command context; legitimate administration can match.", "confidence": "low", "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", "source_ids": [ "poppelgaard" ], "source_urls": [ "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "matching": "pattern", "mapped_from": "community_credential_access" } ] } ], "external_rule_sets": [ { "source": "ncsc-php_webshell_rules.yara", "format": "yara", "rule_names": [ "WEBSHELL_PHP_Generic", "WEBSHELL_PHP_Generic_Callback", "WEBSHELL_PHP_Base64_Encoded_Payloads", "WEBSHELL_PHP_Unknown_1", "WEBSHELL_PHP_Generic_Eval", "WEBSHELL_PHP_Double_Eval_Tiny", "WEBSHELL_PHP_OBFUSC", "WEBSHELL_PHP_OBFUSC_Encoded", "WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex", "WEBSHELL_PHP_OBFUSC_Tiny", "WEBSHELL_PHP_OBFUSC_Str_Replace", "WEBSHELL_PHP_OBFUSC_Fopo", "WEBSHELL_PHP_Gzinflated", "WEBSHELL_PHP_OBFUSC_3", "WEBSHELL_PHP_Includer_Eval", "WEBSHELL_PHP_Includer_Tiny", "WEBSHELL_PHP_Dynamic", "WEBSHELL_PHP_Dynamic_Big", "WEBSHELL_PHP_Encoded_Big", "WEBSHELL_PHP_Generic_Backticks", "WEBSHELL_PHP_Generic_Backticks_OBFUSC", "WEBSHELL_PHP_By_String_Known_Webshell", "WEBSHELL_PHP_Strings_SUSP", "WEBSHELL_PHP_In_Htaccess", "WEBSHELL_PHP_Function_Via_Get", "WEBSHELL_PHP_Writer", "WEBSHELL_ASP_Writer", "WEBSHELL_ASP_OBFUSC", "WEBSHELL_ASP_Generic_Eval_On_Input", "WEBSHELL_ASP_Nano", "WEBSHELL_ASP_Encoded", "WEBSHELL_ASP_Encoded_AspCoding", "WEBSHELL_ASP_By_String", "WEBSHELL_ASP_Sniffer", "WEBSHELL_ASP_Generic_Tiny", "WEBSHELL_ASP_Generic", "WEBSHELL_ASP_Generic_Registry_Reader", "WEBSHELL_ASPX_Regeorg_CSHARP", "WEBSHELL_CSHARP_Generic", "WEBSHELL_ASP_Runtime_Compile", "WEBSHELL_ASP_SQL", "WEBSHELL_ASP_Scan_Writable", "WEBSHELL_JSP_ReGeorg", "WEBSHELL_JSP_HTTP_Proxy", "WEBSHELL_JSP_Writer_Nano", "EXT_WEBSHELL_JSP_Generic_Tiny", "WEBSHELL_JSP_Generic", "WEBSHELL_JSP_Generic_Base64", "WEBSHELL_JSP_Generic_ProcessBuilder", "WEBSHELL_JSP_Generic_Reflection", "WEBSHELL_JSP_Generic_Classloader", "WEBSHELL_JSP_Generic_Encoded_Shell", "WEBSHELL_JSP_NetSpy", "WEBSHELL_JSP_By_String", "WEBSHELL_JSP_Input_Upload_Write", "WEBSHELL_Generic_OS_Strings", "WEBSHELL_In_Image", "WEBSHELL_Mixed_OBFUSC", "WEBSHELL_Cookie_Post_Obfuscation" ], "count": 59, "enabled_in_log_scanner": false, "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." }, { "source": "ncsc-thor-webshells.yar", "format": "yara", "rule_names": [ "Weevely_Webshell", "WEBSHELL_H4ntu_Shell_Powered_Tsoi_3", "WEBSHELL_H4ntu_Shell_Powered_Tsoi", "webshell_PHP_sql", "webshell_PHP_a", "webshell_iMHaPFtp_2", "webshell_Jspspyweb", "webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2", "webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend", "webshell_phpshell_2_1_pwhash", "webshell_PHPRemoteView", "webshell_jsp_12302", "webshell_caidao_shell_guo", "webshell_PHP_redcod", "webshell_remview_fix", "webshell_asp_cmd", "webshell_php_sh_server", "webshell_PH_Vayv_PH_Vayv", "webshell_caidao_shell_ice", "webshell_cihshell_fix", "webshell_asp_shell", "webshell_Private_i3lue", "webshell_php_up", "webshell_Mysql_interface_v1_0", "webshell_php_s_u", "webshell_phpshell_2_1_config", "webshell_asp_EFSO_2", "webshell_jsp_up", "webshell_NetworkFileManagerPHP", "webshell_Server_Variables", "webshell_caidao_shell_ice_2", "webshell_caidao_shell_mdb", "webshell_jsp_guige", "webshell_phpspy2010", "webshell_asp_ice", "webshell_drag_system", "webshell_DarkBlade1_3_asp_indexx", "webshell_phpshell3", "webshell_jsp_hsxa", "webshell_jsp_utils", "webshell_asp_01", "webshell_asp_404", "webshell_webshell_cnseay02_1", "webshell_php_fbi", "webshell_B374kPHP_B374k", "webshell_cmd_asp_5_1", "webshell_php_dodo_zip", "webshell_aZRaiLPhp_v1_0", "webshell_php_list", "webshell_ironshell", "webshell_caidao_shell_404", "webshell_ASP_aspydrv", "webshell_jsp_web", "webshell_mysqlwebsh", "webshell_jspShell", "webshell_Dx_Dx", "webshell_asp_ntdaddy", "webshell_MySQL_Web_Interface_Version_0_8", "webshell_elmaliseker_2", "webshell_ASP_RemExp", "webshell_jsp_list1", "webshell_phpkit_1_0_odd", "webshell_jsp_123", "webshell_asp_1", "webshell_ASP_tool", "webshell_cmd_win32", "webshell_jsp_jshell", "webshell_ASP_zehir4", "webshell_wsb_idc", "webshell_cpg_143_incl_xpl", "webshell_mumaasp_com", "webshell_php_404", "webshell_webshell_cnseay_x", "webshell_asp_up", "webshell_phpkit_0_1a_odd", "webshell_ASP_cmd", "webshell_PHP_Shell_x3", "webshell_PHP_g00nv13", "webshell_php_h6ss", "webshell_jsp_zx", "webshell_Ani_Shell", "webshell_jsp_k8cmd", "webshell_jsp_cmd", "webshell_jsp_k81", "webshell_ASP_zehir", "webshell_Worse_Linux_Shell_1", "webshell_zacosmall", "webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit", "webshell_redirect", "webshell_jsp_cmdjsp", "webshell_Java_Shell", "webshell_asp_1d", "webshell_jsp_IXRbE", "webshell_PHP_G5", "webshell_PHP_r57142", "webshell_jsp_tree", "webshell_C99madShell_v_3_0_smowu", "webshell_simple_backdoor", "webshell_PHP_404", "webshell_Macker_s_Private_PHPShell", "webshell_Antichat_Shell_v1_3_2", "webshell_Safe_mode_breaker", "webshell_Sst_Sheller", "webshell_jsp_list", "webshell_PHPJackal_v1_5", "webshell_customize", "webshell_s72_Shell_v1_1_Coding", "webshell_jsp_sys3", "webshell_jsp_guige02", "webshell_php_ghost", "webshell_WinX_Shell", "webshell_Crystal_Crystal", "webshell_r57_1_4_0", "webshell_asp_ajn", "webshell_php_cmd", "webshell_asp_list", "webshell_PHP_co", "webshell_PHP_150", "webshell_jsp_cmdjsp_2", "webshell_PHP_c37", "webshell_PHP_b37", "webshell_php_backdoor", "webshell_asp_dabao", "webshell_php_2", "webshell_asp_cmdasp", "webshell_spjspshell", "webshell_jsp_action", "webshell_Inderxer", "webshell_asp_Rader", "webshell_c99_madnet_smowu", "webshell_php_moon", "webshell_minupload", "webshell_ELMALISEKER_Backd00r", "webshell_PHP_bug_1_", "webshell_caidao_shell_hkmjj", "webshell_jsp_asd", "webshell_metaslsoft", "webshell_asp_Ajan", "webshell_config_myxx_zend", "webshell_browser_201_3_ma_download", "webshell_itsec_itsecteam_shell_jHn", "webshell_ghost_source_icesword_silic", "webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx", "webshell_2_520_job_ma1_ma4_2", "webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx", "webshell_wso2_5_1_wso2_5_wso2", "webshell_000_403_c5_queryDong_spyjsp2010_t00ls", "webshell_404_data_suiyue", "webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx", "webshell_807_a_css_dm_he1p_JspSpy_xxx", "webshell_201_3_ma_download", "webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download", "webshell_shell_phpspy_2006_arabicspy", "webshell_in_JFolder_jfolder01_jsp_leo_warn", "webshell_2_520_icesword_job_ma1_ma4_2", "webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY", "webshell_shell_phpspy_2006_arabicspy_hkrkoz", "webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx", "webshell_2008_2009lite_2009mssql", "webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz", "webshell_807_dm_JspSpyJDK5_m_cofigrue", "webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx", "webshell_404_data_in_JFolder_jfolder01_xxx", "webshell_jsp_reverse_jsp_reverse_jspbd", "webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc", "webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2", "webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", "webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx", "webshell_itsec_PHPJackal_itsecteam_shell_jHn", "webshell_Shell_ci_Biz_was_here_c100_v_xxx", "webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1", "webshell_c99_c99shell_c99_w4cking_Shell_xxx", "webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", "webshell_c99_c66_c99_shadows_mod_c99shell", "webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1", "webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend", "webshell_c99_c99shell_c99_c99shell", "webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat", "webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx", "webshell_000_403_807_a_c5_config_css_dm_he1p_xxx", "webshell_2_520_icesword_job_ma1", "webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn", "webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY", "webshell_c99_locus7s_c99_w4cking_xxx", "webshell_browser_201_3_ma_ma2_download", "webshell_000_403_c5_queryDong_spyjsp2010", "webshell_r57shell127_r57_kartal_r57", "webshell_webshells_new_con2", "webshell_webshells_new_make2", "webshell_webshells_new_aaa", "webshell_Expdoor_com_ASP", "webshell_webshells_new_php2", "webshell_bypass_iisuser_p", "webshell_sig_404super", "webshell_webshells_new_JSP", "webshell_webshell_123", "webshell_dev_core", "webshell_webshells_new_pHp", "webshell_webshells_new_pppp", "webshell_webshells_new_code", "webshell_webshells_new_jspyyy", "webshell_webshells_new_xxxx", "webshell_webshells_new_JJjsp3", "webshell_webshells_new_PHP1", "webshell_webshells_new_JJJsp2", "webshell_webshells_new_radhat", "webshell_webshells_new_asp1", "webshell_webshells_new_php6", "webshell_webshells_new_xxx", "webshell_GetPostpHp", "webshell_webshells_new_php5", "webshell_webshells_new_PHP", "webshell_webshells_new_Asp", "perlbot_pl", "php_backdoor_php", "Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php", "Nshell__1__php_php", "shankar_php_php", "Casus15_php_php", "small_php_php", "shellbot_pl", "fuckphpshell_php", "ngh_php_php", "jsp_reverse_jsp", "Tool_asp", "NT_Addy_asp", "SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php", "RemExp_asp", "phvayvv_php_php", "klasvayv_asp", "r57shell_php_php", "rst_sql_php_php", "wh_bindshell_py", "lurm_safemod_on_cgi", "c99madshell_v2_0_php_php", "backupsql_php_often_with_c99shell", "uploader_php_php", "telnet_pl", "w3d_php_php", "WebShell_cgi", "WinX_Shell_html", "Dx_php_php", "csh_php_php", "pHpINJ_php_php", "sig_2008_php_php", "ak74shell_php_php", "Rem_View_php_php", "Java_Shell_js", "STNC_php_php", "aZRaiLPhp_v1_0_php", "Moroccan_Spamers_Ma_EditioN_By_GhOsT_php", "zacosmall_php", "CmdAsp_asp", "simple_backdoor_php", "mysql_shell_php", "Dive_Shell_1_0___Emperor_Hacking_Team_php", "Asmodeus_v0_1_pl", "backup_php_often_with_c99shell", "Reader_asp", "phpshell17_php", "myshell_php_php", "SimShell_1_0___Simorgh_Security_MGZ_php", "jspshall_jsp", "webshell_php", "rootshell_php", "connectback2_pl", "DefaceKeeper_0_2_php", "shells_PHP_wso", "backdoor1_php", "elmaliseker_asp", "indexer_asp", "DxShell_php_php", "s72_Shell_v1_1_Coding_html", "kacak_asp", "PHP_Backdoor_Connect_pl_php", "Antichat_Socks5_Server_php_php", "Antichat_Shell_v1_3_php", "Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php", "mysql_php_php", "Worse_Linux_Shell_php", "cyberlords_sql_php_php", "cmd_asp_5_1_asp", "pws_php_php", "PHP_Shell_php_php", "Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html", "EFSO_2_asp", "lamashell_php", "Ajax_PHP_Command_Shell_php", "JspWebshell_1_2_jsp", "Sincap_php_php", "Test_php_php", "Phyton_Shell_py", "mysql_tool_php_php", "Zehir_4_asp", "sh_php_php", "phpbackdoor15_php", "phpjackal_php", "sql_php_php", "cgi_python_py", "ru24_post_sh_php_php", "DTool_Pro_php", "telnetd_pl", "php_include_w_shell_php", "Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php", "shell_php_php", "telnet_cgi", "ironshell_php", "backdoorfr_php", "aspydrv_asp", "cmdjsp_jsp", "h4ntu_shell__powered_by_tsoi_", "Ajan_asp", "PHANTASMA_php", "MySQL_Web_Interface_Version_0_8_php", "simple_cmd_html", "_1_c2007_php_php_c100_php", "_nst_php_php_img_php_php_nstview_php_php", "_network_php_php_xinfo_php_php_nfm_php_php", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php", "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", "_c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php", "_r577_php_php_spy_php_php_s_php_php", "webshell_c99_generic", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", "_w_php_php_wacking_php_php_SpecialShell_99_php_php", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php", "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php", "_r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php", "_wacking_php_php_1_SpecialShell_99_php_php_c100_php", "_r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", "_w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", "multiple_php_webshells", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php", "_GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php", "_w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", "_antichat_php_php_Fatalshell_php_php_a_gedit_php_php", "_c99shell_v1_0_php_php_c99php_SsEs_php_php", "_Crystal_php_nshell_php_php_load_shell_php_php", "_nst_php_php_cybershell_php_php_img_php_php_nstview_php_php", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php", "_c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php", "multiple_php_webshells_2", "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php", "_r577_php_php_r57_php_php_spy_php_php_s_php_php", "_nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php", "DarkSecurityTeam_Webshell", "PHP_Cloaked_Webshell_SuperFetchExec", "WebShell_RemExp_asp_php", "WebShell_dC3_Security_Crew_Shell_PRiV", "WebShell_simattacker", "WebShell_DTool_Pro", "WebShell_IronShell_4", "WebShell_indexer_asp_php", "WebShell_toolaspshell", "WebShell_b374k_mini_shell_php_php", "WebShell_Sincap_1_0", "WebShell_b374k_php", "WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend", "WEBSHELL_H4ntu_Shell_Powered_Tsoi_2", "WebShell_php_webshells_MyShell", "WebShell_php_webshells_pws", "WebShell_reader_asp_php", "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_3", "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2", "WebShell_PHP_Backdoor_2", "WebShell_Worse_Linux_Shell_2", "WebShell_php_webshells_pHpINJ", "WebShell_php_webshells_NGH", "WebShell_php_webshells_matamu", "WebShell_ru24_post_sh", "WebShell_hiddens_shell_v1", "WebShell_c99_madnet", "WebShell_c99_locus7s", "WebShell_JspWebshell_1_2", "WebShell_safe0ver", "WebShell_Uploader", "WebShell_php_webshells_kral", "WebShell_cgitelnet", "WebShell_simple_backdoor_2", "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2", "WebShell_NTDaddy_v1_9", "WebShell_lamashell", "WebShell_Simple_PHP_backdoor_by_DK", "WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT", "WebShell_C99madShell_v__2_0_madnet_edition", "WebShell_CmdAsp_asp_php", "WebShell_NCC_Shell", "WebShell_php_webshells_README", "WebShell_backupsql", "WebShell_AK_74_Security_Team_Web_Shell_Beta_Version", "WebShell_php_webshells_cpanel", "WebShell_accept_language", "WebShell_php_webshells_529", "WebShell_STNC_WebShell_v0_8", "WebShell_php_webshells_tryag", "WebShell_dC3_Security_Crew_Shell_PRiV_2", "WebShell_qsd_php_backdoor", "WebShell_php_webshells_spygrup", "WebShell_Web_shell__c_ShAnKaR", "WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz", "WebShell_Gamma_Web_Shell", "WebShell_php_webshells_aspydrv", "WebShell_JspWebshell_1_2_2", "WebShell_g00nshell_v1_3", "WebShell_WinX_Shell_2", "WebShell_PHANTASMA", "WebShell_php_webshells_cw", "WebShell_php_include_w_shell", "WebShell_mysql_tool", "WebShell_PhpSpy_Ver_2006", "WebShell_ZyklonShell", "WebShell_php_webshells_myshell_2", "WebShell_php_webshells_lolipop", "WebShell_simple_cmd", "WebShell_go_shell", "WebShell_aZRaiLPhp_v1_0_2", "WebShell_webshells_zehir4", "WebShell_zehir4_asp_php", "WebShell_php_webshells_lostDC", "WebShell_CasuS_1_5", "WebShell_ftpsearch", "WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_", "WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah", "WebShell_Generic_PHP_7", "WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall", "WebShell_Generic_PHP_8", "WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php", "WebShell_Generic_PHP_9", "WebShell__PH_Vayv_PHVayv_PH_Vayv", "WebShell_Generic_PHP_1", "WebShell_Generic_PHP_2", "WebShell__CrystalShell_v_1_erne_stres", "WebShell_Generic_PHP_3", "WebShell_Generic_PHP_4", "WebShell_GFS", "WebShell__CrystalShell_v_1_sosyete_stres", "WebShell_Generic_PHP_10", "WebShell_Generic_PHP_11", "WebShell__findsock_php_findsock_shell_php_reverse_shell", "WebShell_Generic_PHP_6", "Unpack_Injectt", "HYTop_DevPack_fso", "FeliksPack3___PHP_Shells_ssh", "Debug_BDoor", "bin_Client", "ZXshell2_0_rar_Folder_ZXshell", "RkNTLoad", "binder2_binder2", "thelast_orice2", "FSO_s_sincap", "PhpShell", "HYTop_DevPack_config", "sendmail", "FSO_s_zehir4", "hkshell_hkshell", "iMHaPFtp", "Unpack_TBack", "DarkSpy105", "EditServer_EXE", "FSO_s_reader", "ASP_CmdAsp", "KA_uShell", "PHP_Backdoor_v1", "svchostdll", "HYTop_DevPack_server", "vanquish", "winshell", "FSO_s_remview", "saphpshell", "HYTop2006_rar_Folder_2006Z", "admin_ad", "FSO_s_casus15", "BIN_Client", "shelltools_g0t_root_uptime", "Simple_PHP_BackDooR", "sig_2005Gray", "DllInjection", "Mithril_v1_45_Mithril", "hkshell_hkrmv", "WEBSHELL_PHP_1", "FSO_s_cmd", "FeliksPack3___PHP_Shells_phpft", "FSO_s_indexer", "r57shell", "bdcli100", "HYTop_DevPack_2005Red", "HYTop2006_rar_Folder_2006X2", "rdrbs084", "HYTop_CaseSwitch_2005", "eBayId_index3", "FSO_s_phvayv", "byshell063_ntboot", "FSO_s_casus15_2", "installer", "FSO_s_remview_2", "FeliksPack3___PHP_Shells_r57", "HYTop2006_rar_Folder_2006X", "FSO_s_phvayv_2", "elmaliseker", "shelltools_g0t_root_resolve", "FSO_s_RemExp", "FSO_s_tool", "FeliksPack3___PHP_Shells_2005", "byloader", "shelltools_g0t_root_Fport", "BackDooR__fr_", "FSO_s_ntdaddy", "nstview_nstview", "HYTop_DevPack_upload", "PasswordReminder", "Pack_InjectT", "FSO_s_RemExp_2", "FSO_s_c99", "rknt_zip_Folder_RkNT", "dbgntboot", "PHP_shell", "hxdef100", "rdrbs100", "Mithril_Mithril", "hxdef100_2", "Release_dllTest", "webadmin", "commands", "hkdoordll", "r57shell_2", "Mithril_v1_45_dllTest", "dbgiis6cli", "remview_2003_04_22", "FSO_s_test", "Debug_cress", "webshell", "FSO_s_EFSO_2", "thelast_index3", "adjustcr", "FeliksPack3___PHP_Shells_xIShell", "HYTop_AppPack_2005", "xssshell", "FeliksPack3___PHP_Shells_usr", "FSO_s_phpinj", "xssshell_db", "PHP_sh", "xssshell_default", "EditServer_2", "by064cli", "Mithril_dllTest", "peek_a_boo", "fmlibraryv3", "Debug_dllTest_2", "connector", "shelltools_g0t_root_HideRun", "PHP_Shell_v1_7", "xssshell_save", "screencap", "FSO_s_phpinj_2", "ZXshell2_0_rar_Folder_zxrecv", "FSO_s_ajan", "c99shell", "phpspy_2005_full", "FSO_s_zehir4_2", "FSO_s_indexer_2", "HYTop_DevPack_2005", "_root_040_zip_Folder_deploy", "by063cli", "icyfox007v1_10_rar_Folder_asp", "byshell063_ntboot_2", "u_uay", "bin_wuaus", "pwreveal", "shelltools_g0t_root_xwhois", "vanquish_2", "down_rar_Folder_down", "cmdShell", "ZXshell2_0_rar_Folder_nc", "portlessinst", "SetupBDoor", "phpshell_3", "BIN_Server", "HYTop2006_rar_Folder_2006", "r57shell_3", "HDConfig", "FSO_s_ajan_2", "Webshell_and_Exploit_CN_APT_HK", "JSP_Browser_APT_webshell", "JSP_jfigueiredo_APT_webshell", "JSP_jfigueiredo_APT_webshell_2", "Webshell_Insomnia", "HawkEye_PHP_Panel", "SoakSoak_Infected_Wordpress", "Pastebin_Webshell", "ASPXspy2", "Webshell_27_9_c66_c99", "Webshell_acid_AntiSecShell_3", "Webshell_c99_4", "Webshell_r57shell_2", "Webshell_27_9_acid_c99_locus7s", "Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57", "Webshell_c100", "Webshell_AcidPoison", "Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256", "Webshell_Ayyildiz", "Webshell_zehir", "UploadShell_98038f1efa4203432349badabad76d44337319a6", "DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3", "Unknown_8af033424f9590a15472a23cc3236e68070b952e", "DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d", "WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901", "webshell_e8eaf8da94012e866e51547cd63bb996379690bf", "Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167", "WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7", "WebShell_Generic_1609_A", "Nishang_Webshell", "PHP_Webshell_1_Feb17", "Webshell_Tiny_JSP_2", "Wordpress_Config_Webshell_Preprend", "PAS_Webshell_Encoded", "ALFA_SHELL", "Webshell_FOPO_Obfuscation_APT_ON_Nov17_1", "WebShell_JexBoss_JSP_1", "WebShell_JexBoss_WAR_1", "webshell_tinyasp", "WEBSHELL_ASPX_Mar21_1" ], "count": 624, "enabled_in_log_scanner": false, "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." } ], "excluded_patterns": [ { "id": "mandiant_log_scrubbing", "pattern": "(?is)(?:crontab|/etc/crontab|sed).*(?:/vpn/scripts/linux|httpaccess|/vpn/media)", "description": "Candidate installer log/crontab cleanup.", "caveat": "Broad contextual rule: require delete/filter/write operation and adjacent installation artifacts.", "source_ids": [ "mandiant" ], "source_urls": [ "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" ], "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", "correlation": null, "reason": "Generic sed/crontab/path co-occurrence does not establish deletion; use a compound cleanup rule instead." }, { "id": "levelblue_customsnmpd", "pattern": "(?is)(?:write|open|>|python|kill).*?/var/python/bin/customsnmpd", "description": "Unexpected replacement or execution of customsnmpd may indicate reverse-shell implant.", "caveat": "File path alone is legitimate; validate modified content and connection to reported callback.", "source_ids": [ "levelblue" ], "source_urls": [ "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" ], "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "correlation": null, "reason": "Generic operation and legitimate component path are insufficient; file-content/network corroboration required." } ], "excluded_observables": [ { "type": "literal", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "python3 -c", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "base64.b85decode", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "base64.b64decode", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "zlib.decompress", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "touch -t", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "apachectl graceful", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "1245184", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "\"nsroot\", \"actions\":", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "literal", "value": "/nf/auth/doDialogue.do", "source": "ncsc-nl-2025", "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." }, { "type": "sha256", "value": "60a9b62d59f1e025b9d1b413ec7c926dbe02134d82e8dea902fcb087c2d81879", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "a5366bdf12ecdd7ff4c87d34ec238717b0c1864598ace0fbd94a5f73f151060f", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "747d21f81f78d55435bc3857cc201f716979f3422d91427ae1355deda1826b5e", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "ee4203c88bd3de082bc67f1de694d93edca795e1106f9f1dbe2e891b3873f83c", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "8fc91bd3436bc6f958ba2f2897956fb3a24c068f55008adb01f3cb32869fec20", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "735e1b0e6ac42ea647198836ec1da79043342596806f83b24584abe79e437405", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "4ff2bdcc36c70c2a8cf298a8b92dc536a14e3fe655aa6de3ac9c1eafb27b4ac4", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "e0898d41e8c5e0b3b4174307be81ad908c23b3b11180083f4252e5b06d8e23b1", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "847d7fc0724470578d4ef8548a2b0eedef54da9ea61c964986e32ae74d90de73", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "10a1acb645b3a4a7cbc1135088429ac3214643facc3f3c783c909446c4142379", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "e1076b3642968044149abe2aabcf681dd22bf3dfb6c1d144f8f3f32a2f12b422", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "77417011220bf8e1d1e51d26c780875cbc51593275ff4080d73bb1da2016fbbb", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "type": "sha256", "value": "2c1310d7c4d7dfb1ef47b137be1eb572cc743cc609898ae38320963cc0578665", "source": "deyda-script", "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." }, { "source": "ncsc-nl-2025", "rule": "NCSCNL_CitrixIncident2025_ropchain", "reason": "Binary wildcard byte sequence requires core-memory YARA; not truthfully equivalent to line-oriented Sigma." } ], "limitations": [ "Reference matches do not prove local compromise. Shared infrastructure and testing markers require context.", "Unavailable registered collections and undisclosed vendor rules are not reproduced.", "Public reports describe attempts and successful intrusions separately; preserve original role and confidence." ] }