Act
archived
Active Exploitation of Citrix NetScaler Flaw Deploys WHIPSHOT/SLAPSHOT
- Engineer — Act: NetScaler ADC/Gateway is actively exploited for root access across multiple enterprise sectors per Mandiant and Google GTIG — patch to the latest released version immediately and audit appliance integrity for WHIPSHOT/SLAPSHOT indicators before treating the host as clean.
- SOC/IR — Act: Active exploitation of a perimeter NetScaler appliance to achieve root access warrants an assume-breach sweep — hunt for WHIPSHOT and SLAPSHOT artifacts on any NetScaler in the estate and review outbound connections from those devices since early September 2026.
- Leader — Plan: Broad targeting across government, finance, technology, education, and legal sectors in North America and Europe elevates organizational exposure if NetScaler is in the stack — confirm with the engineering team that patching is prioritized and ask for a written exposure assessment this week.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.