NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation

SOCRadar reports an active mass-exploitation operation leveraging CVE-2026-88771 (Citrix NetScaler log-injection, CVSSv4 9.5) using an autonomous toolkit called NetScaler C2: the framework discovers FOFA-indexed NetScaler hosts, fingerprints vulnerable builds, injects constrained command payloads to trigger admautoregd processing, and stages a lightweight polling agent (HTTP/DNS callbacks) for command-and-control; the report includes technical exploitation details, IoCs (payload strings, C2 IP 45.143.130.195, agent artifacts like /tmp/.nsagent), and remediation/hunt guidance including affected builds and upgrade recommendations.