Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

Google's Mandiant and GTIG have detailed an espionage campaign that abused two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, for weeks before patches became available over the weekend. Both unauthenticated remote-code-execution flaws hit NetScaler ADC and NetScaler Gateway appliances, and investigators say exploitation began as early as September, well before public disclosure. Suspected state-sponsored actors used the bugs to gain root access, altered the web server configuration to plant root-privileged web shells, and deployed previously unseen tools — a PHP shell called WHIPSHOT and a Python tunneling utility named SLAPSHOT — to pivot into victims' internal networks for reconnaissance, lateral movement and credential theft. Targets span government, financial, education, legal and professional-services organizations across North America and Europe, with researchers tracking dozens to over 100 compromised networks and tens of thousands of exposed instances, prompting urgent calls for immediate patching.