Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

The unknown digital intruders have exploited CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities in Citrix NetScaler Gateway, to break into government agencies, financial services firms, education organizations, and professional services sectors across North America and Europe. The vendor took too long to disclose the security holes, according to GreyNoise and industry experts.

Citrix has a history of delaying the publication of vulnerabilities, even when they're being exploited in the wild and affecting customers. Google Threat Intelligence Group and Mandiant Consulting revealed that the exploitation campaign has been ongoing since early September, targeting organizations in various sectors. Custom malware, including WHIPSHOT and SLAPSHOT, was found to establish persistent root access and proxy traffic into internal corporate networks.

Google Threat Intelligence Group and Mandiant advised NetScaler customers to inspect their systems for compromise before upgrading/patching, as patching alone may not eradicate the threat actor from the environment.