SLAPSHOT

Named by 2 kept items in this workspace.

Search every workspace for SLAPSHOT. It matches the name as written, so it can find other things that share it.

The items that name it 2

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD
writeup2026-10-06
Post-exploitation implant/backdoor installer for compromised Citrix NetScaler ADC/Gateway appliances; 2nd-stage implant dropped after root is obtained via CVE-2026-88771 or CVE-2026-88772. 24 samples analyzed to build a YARA rule; components include agent.pl (Perl loopback TCP multiplexer), bridge.p
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
writeup2026-09-29It is written here as SLAPSHOT: Python TCP proxy/tunneler that binds to 127.0.0.1 on an ephemeral port, uses /tmp/.uxdport and /tmp/.uxdlock, and speaks a length-prefixed JSON protocol.
Python TCP proxy/tunneler that binds to 127.0.0.1 on an ephemeral port, uses /tmp/.uxdport and /tmp/.uxdlock, and speaks a length-prefixed JSON protocol

All threat actors in this workspace.