MalwareExploits 1 CVE

WHIPSHOT

WHIPSHOT is a PHP web shell and tunneling frontend deployed on compromised Citrix NetScaler ADC and Gateway appliances. It has been associated with exploitation of CVE-2026-88771 and CVE-2026-88772, which provided unauthenticated remote code execution on exposed NetScaler systems. WHIPSHOT masquerades as a Debian package and receives Base64-encoded control data in HTTP request headers, allowing its operators to conceal command-and-control traffic within apparently ordinary web requests. It can check for, extract, and start an embedded Python component, then acts as an HTTP bridge to the SLAPSHOT TCP tunneling tool. Together, WHIPSHOT and SLAPSHOT enable operators to proxy traffic from a compromised edge appliance to internal hosts. The tooling was observed in intrusions affecting organizations in North America and Europe, including government, financial services, education, legal, and professional-services entities. Public attribution for the campaign has not been established.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-88772Pre-authentication DTLS Memory Overflow in Citrix NetScaler ADC and GatewayExploited in the wild

CVE-2026-88772 is one of two actively exploited Citrix NetScaler ADC and NetScaler Gateway vulnerabilities. Google reported attacks targeting this vulnerability that deployed the WHIPSHOT webshell and SLAPSHOT TCP tunneling tool. | Google highlighted attacks targeting CVE-2026-88772, which resulted in the deployment of the WHIPSHOT webshell and SLAPSHOT TCP tunneling tool.

via esentire product advisoriesesentire.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

Unknown intruders used CVE-2026-88772 to break into organizations... CVE-2026-88771 can allow an unauthenticated attacker to execute arbitrary commands remotely.

Execution

1 technique

T1059.004Unix ShellEvidence1

Artifacts include “/bin/sh”, “system('/bin/httpd -k restart -f /etc/httpd.conf && chmod u+s /bin/sh');”, and “shell_exec()”.

Persistence

1 technique

T1505.003Web ShellEvidence4

Attackers installed password-protected PHP web shells and modified the NetScaler web-server configuration so ostensibly non-executable extensions would be processed as PHP.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

WHIPSHOT is disguised as a Debian package and hides Base64-encoded command-and-control payloads in native HTTP headers.

T1036MasqueradingEvidence2

The attackers modified /etc/httpd.conf so requests that appeared to be CSS files, .deb packages, .sig files, or .ico images would instead map to malicious PHP files. Some shells returned fake HTTP 404 responses when executing commands.

Credential Access

1 technique

T1552Unsecured CredentialsEvidence1

The threat actor routed traffic through this proxy to manually conduct internal reconnaissance and credential theft.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The threat actor routed traffic through this proxy to manually conduct internal reconnaissance.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

WHIPSHOT extracts Base64-encoded data from HTTP request headers and forwards it to SLAPSHOT; web-shell requests appear as ordinary CSS or image requests.

T1090ProxyEvidence3

WHIPSHOT acts as an HTTP proxy for SLAPSHOT, extracting Base64-encoded data from HTTP request headers and forwarding it to tunneling malware running on the compromised device.

T1572Protocol TunnelingEvidence2

WHIPSHOT is a “PHP webshell tunneling frontend”; SLAPSHOT is a “Python proxy daemon and tunneling tool.” The artifacts use local pointers /tmp/.uxdport and /tmp/.uxdlock and forward traffic to “127.0.0.1”.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

bleeping computerNews

Sep 29, 2026

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Previously undocumented PHP web shell used following exploitation of Citrix NetScaler CVE-2026-88772. It is disguised as a Debian package, proxies command traffic to SLAPSHOT, checks whether SLAPSHOT is running, and can extract and launch embedded Python payloads.

Sep 29, 2026

Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

A previously unseen PHP web shell used following Citrix NetScaler exploitation to establish persistent root-level access. It is disguised as a Debian package, embeds Base64-encoded C2 payloads in HTTP headers, and acts as an HTTP transport bridge for the SLAPSHOT tunneling tool.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

WHIPSHOT