Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor

Binary Defense observed active exploitation of two Citrix NetScaler zero-days (CVE-2026-88771 pre-auth command injection and CVE-2026-88772 DTLS memory overflow) beginning around 2026-09-24, which attackers used to deploy a customized FreeBSD-compatible Platypus implant on compromised ADC/Gateway appliances; investigators recovered FreeBSD and Windows agents, bootstrap installers, and C2 artifacts tied to a private Platypus fork and recommend immediate patching, log review (ns.log), and searches for curl|sh, unusual TLS connections, unauthorized FreeBSD binaries, and files under /var/tmp.