Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771

What it is

watchTowr's honeypot analysis of in-the-wild exploitation of CVE-2026-88771, an unauthenticated command injection in Citrix NetScaler (advisory CTX697096, which fixed eight bugs). The advisory also covers CVE-2026-88772, an unauthenticated DTLS reassembly-buffer overflow. watchTowr says both were exploited as zero-days against government and enterprise targets. The post catalogues what attackers dropped after the bug fired, and gives host artifacts to hunt.

How it works

One crafted request poisons an on-disk log file. A scheduled NetScaler job tied to the Management and Analytics System (MAS) runs the command within the next 24 hours. The script ns_monuploadd_err.pl greps the attacker-controlled line, keeps only the last entry with tail -1, and executes it. Attackers therefore race each other, and only the latest poisoned entry detonates.

A process crash forces execution of the last poisoned entry on the warm reload at restart. watchTowr names a malformed CVE-2026-88772 DTLS request and a SAML DoS, CVE-2026-88779, as crash triggers.

Preconditions / Affected

• An internet-facing NetScaler that is unpatched, or was exposed before patching.
• watchTowr gives no fixed build numbers. Use CTX697096.
• Several payloads depend on config. The Dropbear backdoor is reachable only if the service is exposed via ns.conf on Gateway SSLVPN appliances.

What to do

watchTowr's stance: if the appliance is internet-facing and unpatched, assume compromise. If it is patched, still review it for historical compromise.

Capture volatile evidence (processes, listening sockets, memory-resident implants) before any restart, patch or re-image.

Hunt for these artifacts:

• Anything unusual in /var/tmp, including wtw888, cve88771 and cve88771_round2 (output of id from an LLM-style probe).
• /var/vpn/ns_helper, a Sliver implant fetched with FreeBSD fetch. It beacons every 60 seconds to the exploit-source IP on port 80 or 443. It uses the User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.9565.730 Safari/537.36. Its URL paths are /scripts/bundles/scripts/app.js?m=, /script/bundles/bundles/route.php?n=, /script/scripts?c= and /javascripts/javascripts/javascripts?m=.
• A trojanized static FreeBSD Dropbear SSH 2025.88 listening on tcp/37512. It has the hard-coded password support1 for any account and a hard-coded RSA-2048 key checked before authorized_keys.
• Perl stager update_c08937.pl. Check /flash/nsconfig/ns.conf for a gw_health account bound as superuser, and for httpd config edits.
• A hidden PHP webshell, .local_journal, under /var/netscaler/logon/LogonPoint/. httpd routes /logon/LogonPoint/css/LogonUISimple.html.style.min.<HEX>.css to it. Its password is 01ndx0Fk2oK%bCqj.
• Use of the older public .ctxs.receiver webshell path and its CsrfToken-cookie password, plus follow-up requests running id.
• Spray activity: unexpected authorized_keys entries in /root/.ssh/, /nsconfig/ssh and /nsconfig/.ssh, webshells across 14 directories, pwn.txt marker files in web-accessible directories, and outbound POSTs of tar archives of config directories.
• Callback domains seen: oast[.]fun, dnshook[.]site, webhook[.]site and the lookalike ctrxsrv[.]com.

watchTowr also published an IOC repository. The page text does not give its URL.

If the harvest sweep ran, treat these as stolen: private keys, Git and cloud credentials, SMTP secrets, bearer tokens, API keys, shell history, and LLM API environment variables (OPENAI, ANTHROPIC, GEMINI, CLAUDE). Rotate them.

Caveats

• About 85% of the thousands of attempts were harmless OOB callbacks. Most of the rest were low-skill and many failed.
• The Perl stager's webshell does not work on default NetScaler. nsppe strips Set-Cookie on /logon/*, so the PHP session never persists. The superuser it created is management-plane only, so it is unusable from the Gateway side. A failed implant does not mean the config was not exfiltrated, since the stager also compresses and ships /flash/nsconfig.
• Calling the first probes LLM-generated is watchTowr's guess.
• The telnet and .ctxs.receiver credential-hunting is watchTowr's suspicion, not confirmed.
• Findings come from watchTowr's sensors in the week after disclosure and may not reflect all actors.