Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Threat actors are exploiting a newly patched vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances to gain root access and deploy post-exploitation tools. Multiple threat actors are attempting to exploit the vulnerability, with GreyNoise detecting overlapping activity and CERT-EU identifying attacks leveraging Base64-encoded commands in User-Agent strings.