Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
ID: b548f351-dee8-568d-bf4b-0d64c68cbe05
STIX ID: report--b548f351-dee8-568d-bf4b-0d64c68cbe05
Feed Name: The Register (Security)
Threat Score
The report describes active zero-day exploitation of Citrix NetScaler (CVE-2026-88771 and CVE-2026-88772) targeting government, financial services, education, legal and professional services across North America and Europe; attackers deployed custom persistent tools (WHIPSHOT web shell and SLAPSHOT TCP tunnel) to proxy internal traffic and steal credentials, and defenders are advised to hunt for compromises and preserve evidence before or alongside patching.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.