WHIPSHOT

Exploitation of Unreported NetScaler Vulnerabilities Enables Backdoor Installation and Access to Internal Networks

Attackers exploited two zero-day vulnerabilities in Citrix NetScaler appliances to install PHP backdoors and a network tunneling tool, gain root privileges, steal credentials, and move within networks. Citrix released security updates, while Mandiant warned that disabling DTLS addresses only one of the vulnerabilities.