Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been […]
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Cybersecurity & cyberwarfare
npub1rh…mnrwj
2026-09-30 07:25:36 UTC
Author Public Key
npub1rhyvxl4vpetmjx6fe5syagtlxfr7zhce2ujkxk9j7dxh5rj9rymq4mnrwjSeen on
wss://relay.ditto.pubPublished at
2026-09-30 07:25:36 UTCEvent JSON
{
"id": "794b3fedd585367bd783516f0d5fc63d89542be8db6e1bb4eebcc6b88d918174",
"pubkey": "1dc8c37eac0e57b91b49cd204ea17f3247e15f1957256358b2f34d7a0e451936",
"created_at": 1790753136,
"kind": 1,
"tags": [
[
"p",
"15a03ee92fda904c66e083a3b8c771c462190761797ece68edd34de5e927e321",
"wss://relay.ditto.pub"
],
[
"proxy",
"https://poliverso.org/objects/0477a01e-21d4358b-a60121ca5d9080d1",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been […]\nWHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign",
"sig": "71441b14d65eb76fab90b19cd6e8aaf6dc9d6a76858fcf993365ed2322c45ed4bc924adac7a009fd395409c13feb80a4a35aa77667e5ddf9a53f899821aa91cd"
}