NetScaler Zero-Day Attack Chain: Self-Created Superuser, CSS-Disguised WebShell, and Evidence Destruction

Attackers used two CVSS 9.5 zero-day vulnerabilities to pry open the door of Citrix NetScaler ADC and Gateway devices, then left behind a carefully designed set of artifacts: a local superuser named sec_monitor, a PHP WebShell disguised as a CSS stylesheet URL, a full device configuration backup, and — the most unsettling step of all — a script that automatically deletes all evidence.

This post-mortem analysis released by LevelBlue's Threat Hunting and Operations Research (THOR) team is a rare, complete look at what attackers do "next" after a vulnerability is disclosed. Patching fixes a door, but it does nothing against attackers who are already inside.

---

Two Zero-Days, and a Default Configuration Is All It Takes

CVE-2026-88771 is a 9.5-rated pre-auth command injection vulnerability. Its scope, in Citrix's own advisory language, is all NetScaler ADC and Gateway deployments, including default configurations. No additional features need to be enabled, no specific virtual server type is required, and no configuration option matters — the device is exposed straight out of the box.

CVE-2026-88772 is also rated 9.5 and is a memory overflow vulnerability reachable via DTLS. It has a precondition, but that precondition is precisely what's enabled by default: DTLS on the VPN virtual server is on by default, and the VPN virtual server is the core configuration that makes NetScaler Gateway a VPN gateway. The attack chain documented by Mandiant and Google's threat intelligence team shows attackers bypassing authentication and triggering an unhandled termination in the NetScaler Packet Processing Engine (NSPPE), establishing initial root-level access on the underlying FreeBSD platform.

The vulnerability timeline itself is a textbook example of zero-day response cadence: the Dutch National Cyber Security Centre (NCSC-NL) advised operators to shut down devices in a private pre-notification, prompting administrators to respond publicly on September 26; Citrix released fixed versions on September 27; and CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day. From private warning to public release: less than 24 hours.

---

Pre-Auth vulnerability refers to a vulnerability that attackers can exploit without holding any valid credentials and without first logging into the device. The opposite is a post-auth vulnerability, which requires the attacker to already have a legitimate account. The danger of pre-auth vulnerabilities is that the device's authentication mechanism itself not only fails to provide protection, but has already fallen before the attacker even obtains credentials, turning internet-exposed management interfaces or VPN portals into direct attack entry points. CVE-2026-88771 is rated CVSS 9.5 precisely because it requires no preconditions; while CVE-2026-88772 is pre-auth reachable, it relies on DTLS — a service enabled by default — as its reachable path. For devices like NetScaler that sit at the network edge and carry VPN and authentication functions, a pre-auth vulnerability means the defense boundary has already failed before the attack even begins.

NSPPE (NetScaler Packet Processing Engine) is the underlying core component NetScaler uses to handle network traffic, responsible for parsing, forwarding, and terminating packets entering and leaving the device. It runs on NetScaler's own FreeBSD base platform and operates as a high-privilege (typically root-level) process in exchange for the minimal overhead needed to handle high-throughput traffic. Because NSPPE directly processes raw packets from the network, it becomes a high-value target for memory overflow vulnerabilities: once an attacker triggers an unhandled memory error by crafting malformed packets, they may hijack the process's execution flow and gain root privileges on the underlying operating system. CVE-2026-88772 reaches this engine via DTLS and triggers an unhandled termination, completing the leap from network packet to operating system root — the most dangerous class of path in edge device exploitation.

Post-Exploitation Script: Designed So You Can't Find It

The most instructive detail in the LevelBlue report isn't the exploitation itself, but the second-stage payload. A Perl script named update_c08937.pl performs four things in sequence:

1. Modifies /flash/nsconfig/ns.conf to create a local account named sec_monitor and grant it the superuser role — this account is written into the configuration file, meaning it persists after reboot
2. Packages the entire /flash/nsconfig directory as /tmp/update_result_3567cs.tgz, uploaded to 64.94.85[.]67:443 — this contains the device's full configuration information
3. Changes /bin/sh permissions to 6555, and deploys a PHP WebShell at /var/netscaler/logon/LogonPoint/.local_journal, supporting remote command execution and file upload/download
4. Deletes the archive file and clears itself

The final step deserves special emphasis: this script is designed to actively shrink the on-disk forensic footprint. Whoever wrote it assumed defenders would examine the device afterward, and wanted the "story" visible at that point to be as short as possible.

LevelBlue's summary of the overall pattern is more precise than any paraphrase: "Some attempts used commands like whoami to test command execution, while others attempted to obtain additional payloads, collect NetScaler configuration data, establish reverse shells, create privileged accounts, and deploy WebShells." This is an intrusion playbook written in a single sentence, where every item represents a persistence capability rather than a temporary foothold.

---

What the Toolkit Reveals About the Attacker

Putting LevelBlue's telemetry together with Mandiant's toolkit analysis, the attacker's behavioral pattern becomes clear: they weren't scanning for a shell and leaving. They were after three things — device configuration, a persistent superuser identity that survives reboots, and a WebShell that looks like a stylesheet.

The PHP WebShell was placed at LogonPoint/.local_journal, intentionally mapped to a URL resembling a legitimate NetScaler CSS resource. GreyNoise's observations corroborate this technique from the side. This is an evasion strategy specifically designed for the "weak security team monitoring" device category — most NetScaler deployments sit at the network edge, and their logs are only read by themselves.

The second notable characteristic is paired tooling. Mandiant described WHIPSHOT (a PHP WebShell that hides Base64-encoded command-and-control payloads in native HTTP headers) working in tandem with SLAPSHOT (a Python tunneling tool that proxies traffic into the internal network for reconnaissance and credential theft). In at least one observed intrusion, the attacker manually conducted internal reconnaissance through the tunnel. This isn't automation for automation's sake — it's an operator establishing a stable internal network channel before making any noise.

---

WHIPSHOT and SLAPSHOT are two post-exploitation tools that Mandiant attributed to this attack campaign, with clear division of labor. WHIPSHOT is a PHP WebShell whose distinguishing feature is stuffing Base64-encoded command-and-control payloads into native HTTP request headers, making malicious traffic look indistinguishable from ordinary requests in standard HTTP logs and evading content-based detection. SLAPSHOT is a Python-based tunneling tool that proxies external traffic into the internal network, providing attackers with a stable channel for internal reconnaissance and credential theft. Together they represent a mature operational rhythm: first use a WebShell to establish a foothold in the internal network, then use a tunnel to move laterally, establishing a sustainable internal channel before producing any obvious noise. This contrasts sharply with opportunistic "scan a shell and leave" attacks, indicating the operator had clear long-term residency intentions.

The Correct Response Order: Forensics First, Patch Second

Citrix, CISA, and watchTowr have reached a rare consensus on response order, and that consensus is uncomfortable: don't patch immediately. CISA recommends checking for compromise and preserving forensic evidence before updating, because the update itself may wipe out evidence of an existing intrusion.

watchTowr explicitly laid out the sequence:

1. Capture logs, snapshots, support bundles, and core dumps from every exposed device — before upgrading
2. Run IOC scans — via the NetScaler Console security advisory page (14.1-73.36 or higher, with telemetry enabled), or request generic IOCs from Citrix support
3. Install the fixed version — the 13.1 branch requires running show ns variable first, because 13.1-64.23 has a known boot loop issue when upgrading, fixed in 13.1-64.24
4. Rotate credentials — including passwords, keys, and certificates stored on or used through the device
5. Forward NetScaler logs to an external SIEM, and move management interfaces off the public internet

It's worth noting that Citrix's own IOC guidance comes with an honest disclaimer: these indicators don't cover all techniques, tactics, and procedures, and their forensic value may be limited. A clean IOC scan is just one data point among many.

---

Capturing core dumps before upgrading is an action repeatedly emphasized in this incident yet easily overlooked. A core dump is a file written to disk by the operating system containing the memory image of a process when it crashes. For memory overflow vulnerabilities like CVE-2026-88772, it may preserve fragments of attacker-injected payloads, hijacked execution paths, and direct evidence of the exploitation technique. Support bundles and snapshots record device configuration, logs, and runtime state. The emphasis on "before upgrading" is because installing the fixed version restarts services, overwrites configuration files, and cleans temporary directories — thereby erasing traces left by attackers. Once this evidence is lost, even if you later suspect the device was compromised, you may never be able to confirm the scope and duration of the attack, let alone determine whether other persistent backdoors remain undiscovered.

Why Edge Devices Deserve "Crown Jewel" Treatment

The most unsettling fact about this campaign is that the exploited device is precisely the one sitting between the office and all internal applications, handling VPN, remote access, load balancing, and authentication. A compromised NetScaler gives an attacker a foothold at the boundary plus a channel to internal systems, and the post-exploitation toolkit is designed to make that channel permanent — a superuser account in the configuration, a WebShell that looks like a CSS file, and a tunnel into the internal network.

This echoes exactly the management-plane argument we made when discussing hardcoded credentials in NVIDIA infrastructure controllers: when edge devices become the trust boundary, the question is no longer "does this product have vulnerabilities" but "can we detect and evict those who have already entered." NetScaler post-exploitation attacks now have a standard answer — the payload is designed to make the second half as difficult as possible. Pre-upgrade evidence capture isn't bureaucratic process; it's the only part that still works after attackers have finished cleaning up their traces.

This pattern applies to every device category that combines remote access and local logging: preserve evidence before patching, treat clean scan results as one signal among many, and assume the payloads that ran understand how to hide themselves better than your first forensic check does.

Fixed versions have been released on the 14.1-73.37 and 13.1-64.23 branches. Patching is the easy part of this incident — it always has been. The hard part is the evidence you choose to capture before upgrading, or lose forever.

One-line Summary

After Citrix NetScaler was breached via two 9.5-rated zero-days, attackers deployed persistent superusers, disguised WebShells, and auto-destruct evidence scripts.

Paragraph Summary

LevelBlue's THOR team disclosed a post-mortem analysis of Citrix NetScaler ADC and Gateway devices attacked via two CVSS 9.5 zero-days (CVE-2026-88771 pre-auth command injection, CVE-2026-88772 DTLS-reachable memory overflow). After gaining root access, attackers ran a Perl script to create a persistent superuser sec_monitor, exfiltrate the full configuration directory, deploy a PHP WebShell disguised as a CSS resource URL, and finally delete archives and scripts to shrink the forensic footprint. The toolset included the WHIPSHOT WebShell hidden in HTTP headers and the SLAPSHOT tunnel for internal network proxying. Citrix, CISA, and watchTowr unanimously advise: capture logs, snapshots, and core dumps before upgrading, because patching will erase intrusion evidence. As an edge trust boundary, a compromised NetScaler means a permanent channel into the internal network.