Mandiant named WHIPSHOT on NetScaler. Today's KEV clock does not remove it.

CVE-2026-88772 has been in since early September. The federal due is 30 September. The ISO does not delete the PHP.

RWP Ventures · 2026-09-30 · event 2026-09-29 · 15 min read · priority 9.1

This is not [Monday’s Daily Top](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/) rewritten. Monday was the catalog row. Today is what was already on the box.

Do not collapse four facts.

1. The ISO is not the hunt. CISA still flags forensic triage Yes on both KEV rows. Mandiant: web-server handler changes, SUID on /bin/sh, and dropped PHP can survive an upgrade and can replicate across an HA pair if you leave config sync on. A 14.1-73.37 build without a file-system review is a patched beachhead.
2. 88772 is the Mandiant campaign CVE. 88771 is still in, and still KEV. GTIG’s frontline telemetry is the DTLS / NSPPE path. Citrix separately confirmed in-the-wild use of CVE-2026-88771 (unauthenticated command execution, default configuration, no extra feature). GreyNoise retro-tagged 88771 attempts from 149.104.78.141 on 24 September, three days before CTX697096. Turning DTLS off does not close 88771.
3. GTIG did not name an actor in the blog. Mandiant CTO Charles Carmakal, quoted by CyberScoop, said the firm is “aware of dozens of impacted organizations” and attributed the activity to “advanced and suspected state-sponsored threat actors.” That is REPORTED from a LinkedIn statement, not a GTIG cluster ID. Do not import last year’s NetScaler ransomware history onto this kit. CISA’s ransomware field is still Unknown.
4. Yesterday’s Apple story moved onto KEV overnight. That is not this interrupt. Catalog 2026.09.29 (released 29 September 13:51 UTC, count 1729) added CVE-2026-86950, due 2 October. We already assessed the CoreGraphics bug [yesterday](/posts/2026-09-29-apple-cve-2026-86950-coregraphics/). A KEV stamp on a targeted iOS parser is expected. A named post-exploit kit on the perimeter, with a due date of today, is the operational ticket.

What happened

Sunday 27 September, Citrix published CTX697096 and CISA put CVE-2026-88771 and CVE-2026-88772 on KEV, due 30 September. That was [Monday’s Daily Top](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/): default-config unauthenticated command execution, DTLS-on-VPN second RCE, forensic triage Yes, no named kit.

Tuesday 29 September the primary hunt arrived.

Mandiant / GTIG: exploitation of CVE-2026-88772 identified in late September, ongoing since at least early September. GTIG does not claim to possess exploit code. Frontline telemetry: malformed or fragmented DTLS record headers during the pre-authentication handshake induce heap corruption in the NetScaler Packet Processing Engine (NSPPE) and divert control flow to shellcode as root on the underlying FreeBSD. Successful attempts left two log artifacts together: an SSL_HANDSHAKE_FAILURE with ClientVersion DTLSv1.0 and reason Handshake failure-Internal Error, then an NSPPE exit that pitboss did not restart.

Post-exploit, the actor does not live in NSPPE. It installs PHP that the appliance’s own httpd will run.

Two persistence methods Mandiant recovered:

• Package-handler masquerade. /etc/httpd.conf is edited so .deb is handled as PHP (AddHandler application/x-httpd-php .deb). Shells land in /netscaler/gui/vpn/scripts/linux (and the /var/netscaler/gui/vpn/scripts/linux tree), where legitimate client plug-ins are compiled binaries.
• Icon alias. AliasMatch maps /vpn/media/*.ico to a .sig file in the VPN scripts directory, and .sig is registered as PHP. A request for /vpn/media/e6ee7c85.ico executes e6ee7c85.sig. Access logs can show HTTP 404 with long duration and multi-kilobyte bodies.

The web server does not run as root. The installer sets chmod u+s /bin/sh, then reboots the appliance (/netscaler/nsshutdown -R) or restarts httpd so the handler change and the SUID bit stick. Some installer variants scrub /vpn/scripts/linux references out of /etc/crontab.

WHIPSHOT is the larger PHP implant. It launches SLAPSHOT in the background via nohup and a Base64-decoded Python one-liner, reads a dynamic port from /tmp/.uxdport, and relays client traffic to 127.0.0.1. Commands arrive in HTTP_X_UX / HTTP_X_UX_[n] headers. The HTTP response code is forced to 404.

SLAPSHOT is a Python TCP tunnel. It binds an ephemeral port on localhost, locks /tmp/.uxdlock, and speaks a length-prefixed JSON protocol (open, push, pull, exch, close, ping). In at least one intrusion Mandiant watched, the operator used that proxy for manual internal reconnaissance and credential theft. The process can idle-exit and delete its port/lock files.

Lightweight installer shells Mandiant named in the same write-up are not WHIPSHOT. They used HTTP_NSC_LDAP or HTTP_NSC_CLIENTTYPE for Base64 command channels (shell_exec / eval), filenames that varied by victim (including nginstaller* and e6ee7c85.sig), and the same SUID / httpd-restart playbook.

GreyNoise (28 September) is the independent 88771 datapoint. On 24 September 07:32 UTC, 149.104.78.141 hit a Swarm sensor. GreyNoise labeled the IP malicious in seconds and, after the 27 September CVE tag, retro-tagged the session as CVE-2026-88771. The actor failed to get a foothold on that sensor; the attempted playbook still matters: setuid and setgid on /bin/sh, a password-protected PHP file at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (SHA-256 6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7), Alias / AliasMatch from receiver.min.css / receiver.min.[hex].css onto that hidden file, then kill httpd to reload. That is a LogonPoint path, not the VPN-scripts path Mandiant recovered. Treat the two as related tradecraft, not one implant family, until someone publishes a join.

watchTowr (29 September) published the 88772 root-cause they patched against: DTLS handshake reassembly copies an NSB chain into a 35,840-byte (0x8c00) NSPPE scratch buffer without a remaining-size check. Fixed builds start that copy with a bounds compare. RWP is not reproducing record layouts, fragment offsets, or detection-artifact generators. The defender cut is: DTLS is on by default on VPN virtual servers unless -dtls OFF was set, and the crash/handshake pair Mandiant published is the on-box fingerprint.

CISA’s live catalog this morning is 2026.09.29, 1729 rows. The NetScaler pair is unchanged (added 27 September, due today, ransomware Unknown, forensic triage Yes). The new row is Apple CVE-2026-86950, due 2 October — yesterday’s Daily Top, now stamped.

Why it matters

NetScaler ADC and Gateway still sit on the WAN side of identity: SSL VPN, ICA/CVPN, AAA, load balancing in front of whatever the enterprise was willing to publish. Monday’s assessment was that unauthenticated command execution there is not “a reverse-proxy CVE.” Tuesday’s hunt is the reason that sentence was not academic.

Three operational lies are now in the ticket, not two.

1. “We patched NetScaler in August.” Still false. [CVE-2026-19490](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) closed in 14.1-73.32 / 13.1-63.21, inside today’s affected range.
2. “We will disable DTLS / lock the NSIP.” Still false for 88771. Mandiant’s compensating controls for 88772 are explicit: disable DTLS where you can, and block inbound UDP/443 upstream of the appliance — local NetScaler ACLs still let the packet hit NSPPE. Those controls do not cover 88771. The only closure for both is a fixed build.
3. “We took 14.1-73.37 this morning.” New, and the one this Daily Top exists to kill. Mandiant’s installer writes httpd.conf, SUID, and PHP into directories that HA sync will copy. Carmakal’s public instruction, via CyberScoop and BleepingComputer: hunt before and while patching. CISA BOD 26-04 already said the same in the KEV notes. The firmware ISO is not a disk wipe.

Mandiant’s sector list is a bounded observation, not a global victim census and not a statement that industrial control networks were hit. A NetScaler in front of an OT remote-access path is still an IT perimeter compromise until evidence shows process impact. None is in this record.

GTIG’s broader point is the one edge teams already know: these appliances are internet-facing, sit outside EDR, and hold credentials. The new fact is the kit — custom PHP that returns 404, a Python loopback tunnel, and a reboot to make SUID permanent.

Who / what is affected

Technical context

RWP is not reproducing DTLS fragments, heap offsets, or exploit payloads. watchTowr’s patch diff is enough for a defender: the vulnerable NSPPE copy had no remaining-size check; 14.1-73.37 does.

What to hunt, from Mandiant’s published guidance — configuration and artifacts, not an exploit path:

• /etc/httpd.conf (also /nsconfig/httpd.conf, /flash/nsconfig/httpd.conf): AddHandler / AddType registering non-PHP extensions (.deb, .sig, .rpm, .tgz, .html) as application/x-httpd-php; AliasMatch from /vpn/media/, /vpn/theme/, /vpn/images/ into script directories; php_flag engine on next to those aliases.
• VPN plug-in trees: /var/netscaler/gui/vpn/scripts/linux/, .../vista/, .../mac/, /netscaler/ns_gui/vpn/media/. Legitimate contents are compiled binaries or archives. ASCII text or PHP in those paths is anomalous.
• LogonPoint (GreyNoise, not GTIG): /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver and aliases for receiver.min.css.
• /bin/sh permissions: -rwsr-xr-x owned by root is the SUID persistence Mandiant documented.
• /tmp/.uxdport and /tmp/.uxdlock: SLAPSHOT live or recent.
• Syslog: SSL_HANDSHAKE_FAILURE + DTLSv1.0 + Handshake failure-Internal Error, clustered with NSPPE exit and pitboss NOT restarting NSPPE.
• Web logs: 404s on /vpn/media/ or /vpn/scripts/ with large bodies or long duration; gaps around those paths (regex wiper).
• Process list: Python under nohup referencing those tmp files or base64.
• Headers worth alerting in TLS-terminated HTTP logs, if you have them: HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE, HTTP_X_UX / HTTP_X_UX_*.

Mandiant network indicators from the same post: inbound UDP/443 DTLSv1.0; IPv4 143.198.7.94 (scanning/staging) and 157.254.167.12 (exploitation and basic web-shell install). GreyNoise exploitation source: 149.104.78.141. eSentire published additional IPs and two SHA-256s on 29 September; treat those as REPORTED secondary unless you match them on disk. GTIG also shipped YARA for WHIPSHOT, SLAPSHOT, httpd.php-handler configs, NSC-header shells, and persistence scripts — consume from the Mandiant post, not from a recap.

ATT&CK mapping for the ticket, not a kill chain we ran:

Threat / exploitation status

Confidence on the malware families, the hunt artifacts, the KEV clock, and the two-precondition split: high. Confidence on actor, victim count, and ransomware: low. Confidence on “state-sponsored”: low until GTIG or CISA puts a cluster on it.

What defenders should do

1. Treat every internet-facing customer-managed ADC/Gateway below 14.1-73.37 / 13.1-64.23 (and the matching FIPS/NDcPP floors) as in-scope for both CVEs, including HA peers. Record the build. Do not skip August-19490 boxes.
2. Preserve, then hunt, then patch — in that order on anything that was reachable. Support bundle, /var/log/messages, ns.log, httpaccess / httperror, VM snapshot with memory if VPX. BOD 26-04: the update can destroy the evidence. Hunt both HA nodes with sync disabled if you already suspect one. Mandiant’s grep/ls list above is the first pass; Citrix Console IoC (14.1-73.36+, telemetry on) is a vendor first pass, not clearance.
3. If you find WHIPSHOT/SLAPSHOT artifacts, SUID /bin/sh, or unauthorized AddHandler/AliasMatch: isolate the node, halt HA sync, restrict egress, rebuild. CTX694799 still applies. Rotate appliance admin, SSH keys, TLS certs/keys, LDAP bind, RADIUS, TACACS, SNMP, NITRO. Revoke Gateway/ICA sessions. Hunt StoreFront, DDCs, and anything the SNIP talked to. Mandiant: rotate after the box is on a fixed build, not before you have somewhere clean to land.
4. Install the fixed build. There is still no published workaround that closes both CVEs. DTLS-off plus upstream UDP/443 deny is a 88772-only delay, and only if you can live without DTLS. On 13.1, Monday’s watchTowr note still stands as REPORTED: if show ns variable is non-empty, confirm 13.1-64.24 with Citrix Support before you take 64.23. After upgrade, enable Enhanced ISN Generation for 88778.
5. Do not let a clean Console scan close the ticket. Citrix already said its IoCs will miss TTPs. Mandiant’s kit was designed to look like a 404 for an .ico.
6. Keep the rest of this window on the board. Apple CVE-2026-86950 is now KEV, due 2 October, forensic triage Yes — yesterday’s story, now a federal clock. SharePoint CVE-2026-65660, WordPress CVE-2026-87902, and MikroTik CVE-2026-67279 were due 28 September. Internet-facing NetScaler is today’s interrupt; those clocks did not pause.

RWP assessment

Score 9.1.

Highest-leverage development since yesterday’s Apple CoreGraphics piece is new technical findings and new victim-impact detail on a KEV pair whose federal due date is today: custom malware families, persistence that survives the ISO, HA-sync replication, a published hunt, and independent GreyNoise pre-disclosure 88771 activity. Evidence quality is high: GTIG/Mandiant primary, Citrix bulletin, CISA JSON, GreyNoise, watchTowr root cause.

It outranks a second day on CVE-2026-86950 because yesterday already assessed the bug, the iOS-before-27 targeting sentence, and the lagging 26/Sequoia/Tahoe fleet. Today’s KEV add is a catalog stamp, not a new exploitation picture. It outranks DIVD’s reported AI-agent post-exploitation (29 September) because the vulnerability, actor, and impact are still UNKNOWN. It outranks the Dutch ShinyHunters arrest and FBI surrender appeal because that is law enforcement, not a defender action on an internet edge box. It outranks Keio’s ransomware (trains reported unaffected) because that remains an IT business-systems incident with no confirmed OT impact.

What we are not saying: that ransomware is using 88771/88772; that a named APT owns WHIPSHOT; that every 404 on /vpn/media/ is this actor; that disabling DTLS remediates the lead default-config RCE; that a NetScaler in an industrial DMZ is confirmed process impact.

What we are watching

• Whether GTIG, CISA, or Citrix puts a cluster, a nation-state assessment, or a ransomware flag on this kit.
• Whether 88771 and 88772 stay one campaign or split (GreyNoise LogonPoint vs Mandiant VPN-scripts).
• HA-sync and upgrade-survival confirmations from operators, not just from Mandiant’s lab notes.
• Coverage of /tmp/.uxd* and SUID /bin/sh in vendor Console IoCs.
• Apple CVE-2026-86950 due 2 October — clock, not this story.
• Whether 88773–88778 pick up exploitation and join KEV.

Sources

• Mandiant / GTIG — Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances (29 September 2026)
• CISA — KEV JSON catalog 2026.09.29
• CISA — Adds two known exploited vulnerabilities (27 September 2026)
• CISA — Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC, Gateway
• CISA — Adds one known exploited vulnerability (29 September 2026, CVE-2026-86950)
• Citrix CTX697096 — NetScaler ADC and Gateway security bulletin
• Citrix CTX694799 — steps if NetScaler ADC is suspected compromised
• GreyNoise — Swarming Against Citrix 0-Day Exploitation
• watchTowr — CVE-2026-88772 DTLS preauth memory overflow
• BleepingComputer — Hackers exploit Citrix NetScaler zero-day to deploy web shells
• CyberScoop — Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
• CVE-2026-88771 · NVD
• CVE-2026-88772 · NVD