Malware1 associated CVE

NetScaler C2

Tracked since Oct 7, 2026 · Updated 28 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

3 mentions · peak 2 in a dayToday

Vulns1Associated

Actors0Associated

ATT&CK0Techniques

IOCs2Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Associated CVEs

Associated vulnerabilities

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.

CVE-2026-88771via socradar blogExploited in the wildUnauthenticated command injection in Citrix NetScaler ADC and GatewayCVE-2026-88771 (9.5 CVSS v4.0) lets unauthenticated attackers run arbitrary commands, even on default configurations. | On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2, an autonomous framework that runs every 30 minutes.View vulnerability →Source ↗

Indicators of compromise

Observables

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

malware newsNews · Oct 27, 2026September 2026: FBI Breach, Clop Hijack & IDScan Leak - Malware News - Malware Analysis, News and IndicatorsAutonomous attack framework that retrieves exposed hosts from FOFA, fingerprints their versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands. It runs every 30 minutes and can enumerate up to 120,000 candidate hosts per cycle; the number successfully compromised is unknown.Read more ↗socradar blogNews · Oct 27, 2026September 2026: FBI Breach, Clop Hijack & IDScan LeakAutonomous attack framework that retrieves exposed hosts from FOFA, fingerprints NetScaler versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands. Each run can enumerate up to 120,000 candidate hosts; the number successfully compromised is unknown.Read more ↗socradar blogNews · Oct 7, 2026NetScaler C2: A Massive CVE-2026-88771 Exploitation OperationAutonomous exploitation and command-and-control toolkit targeting vulnerable Citrix NetScaler ADC and Gateway appliances. It discovers exposed devices through FOFA, fingerprints affected builds, and injects commands into appliance logs through unauthenticated HTTP endpoints. Subsequent log processing can execute these commands as root, potentially after a delay of up to 24 hours. Successful exploitation installs a lightweight agent at /tmp/.nsagent that registers device information, polls an HTTP C2 server every 20 seconds, executes operator commands, and returns hex-encoded results. DNS out-of-band callbacks separately confirm exploitation. Operators can access individual device shells, broadcast commands, and review session history. The report describes indicators suggesting Chinese-speaking developers and AI-assisted development, but identifies no named threat actor and does not independently establish the number of compromised appliances.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching2Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilities1CVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Malware1 associated CVE

NetScaler C2

Tracked since Oct 7, 2026 · Updated 28 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

3 mentions · peak 2 in a dayToday

Vulns1Associated

Actors0Associated

ATT&CK0Techniques

IOCs2Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Associated CVEs

Associated vulnerabilities

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.

Indicators of compromise

Observables

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matching2Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilities1CVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.