In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.
The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Directory, management services and VMware vCenter infrastructure, and exfiltrated NetScaler configuration and key material.
The activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign. However, this case provides additional detail on the operational lifecycle, including repeated post-reboot execution through the crash-handling workflow, HA-aware persistence, a dedicated Go reconnaissance tool, a separate FreeBSD proxy agent, and a staged collection pipeline.
Key findings
-
The first confirmed root execution occurred shortly after attacker-controlled text was inserted into a NetScaler authentication username.
-
The injected text caused or immediately preceded repeated nsaaad crashes and a Pitboss reboot.
-
After reboot, the NetScaler call-home crash handler processed the retained attacker-controlled text and executed a payload as root.
-
The attacker installed cookie-authenticated PHP web shells behind CSS-looking Apache aliases.
-
The attacker set /bin/sh to mode 6555, allowing an unprivileged web process to obtain effective root privileges.
-
The implant framework maintained access through cron, rc.netscaler, watchdog loops, an outbound reverse agent, and an HTTP-fronted TCP proxy.
-
HA synchronization and forced failover logic attempted to preserve access across the appliance pair.
-
A Go tool mapped internal routes, DNS, LDAP/AD, management services and VMware vCenter systems.
-
NetScaler configuration, historical configurations, HTTP configuration, diagnostics and system backup material were staged for exfiltration.
Technical AnalysisInitial access
The first event was an authentication request containing attacker-controlled text similar to:
pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v ...;sh${IFS}/v;#
The observed chain was:
Figure 1: Sequence diagram showing the attack chain
Logs collected show attackers chaining CVE-2026-88771, the pre-authentication log-poisoning/RCE issue, with CVE-2026-88779, the separate SAML-parsing crash. A two-vulnerability sequence in which the SAML parsing flaw supplies a crash/reboot condition while the log-poisoning flaw supplies attacker-controlled command text.
The evidence demonstrates more than an attempted chain: the injected command, nsaaad crash loop, Pitboss reboot, post-reboot handler activity, and root payload execution are all directly correlated across independent logs and filesystem timestamps. The first implant files were created at the same second as the first logged post-reboot execution, and later stages, web shells, tunnels, reconnaissance tooling and exfiltration were confirmed.
Rapid7 also published an ETR on the Netscaler zero days currently exploited in the wild.
Repeated post-reboot execution
The initial execution was not a one-time event. The appliance recorded repeated Pitboss-initiated reboots and repeated call-home handler executions over several days.
The handler re-executed stages from multiple infrastructure addresses and the repeated execution model allowed the operator to refresh persistence, deploy new components and continue collection after appliance restarts.
The crash-handling path functioned as a delayed and repeatable execution trampoline, the chaining happened to avoid waiting 24h for the injected payload to run.
Payload evolution
Two .slap dropper versions were recovered:
17447d.sh (earlier version) SHA-256: a0ba4e1ad622d9c3d950b4156d4430812d05bee216ab22c3804a9f7a80535556
and:
1.sh SHA-256: 6774bfed99da38cec82e721de4bd64a67db7840efadcc71e7df02eb6f0a03c44
The later version added reverse-agent functionality, relay installation, HA recovery, stage tracking, and structured upload logging, indicating operational maturation during the campaign.
The nsvmd installer branch was separately identified as:
2.sh / r.sh SHA-256: 56a892d80096a9db4ca473a9c3109729c60a5ba901d6ba65948bdb1f4a6fb186
Persistence and web shells
The main framework used a directory under /nsconfig/.slap.
/nsconfig/.slap/vc /nsconfig/.slap/vcscan-agent.sh /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl /nsconfig/.slap/boot.sh /nsconfig/.slap/reverse-agent.sh
It deployed three web shell copies into the LogonPoint custom web directory:
.slap.receiver .ctxs.receiver receiver.deb
The shells used a cookie-based command channel. Commands were supplied through a second cookie and returned through an HTTP 404 response body. The 404 response helped the shell blend into normal web traffic and made successful command requests resemble missing resources.
The attacker modified Apache configuration to:
-
execute
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: