Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

Government and financial organizations have been targeted in a weeks-long campaign exploiting zero-day vulnerabilities in Citrix NetScaler. Mandiant and Threat Intelligence Group (GTIG) discovered a sophisticated attack involving a new PHP web shell (WHIPSHOT) and a Python tunneling tool (SLAPSHOT), enabling attackers to gain root access and conduct reconnaissance within victim networks.