Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Unknown attackers exploited a newly patched Citrix NetScaler ADC and Gateway flaw to gain root access and deploy WHIPSHOT and SLAPSHOT malware, targeting organizations in North America and Europe. Mandiant Consulting and Google Threat Intelligence Group observed the activity in September 2026, hitting government, financial, technology, education, and legal sectors. The attacks used the vulnerability for initial access and privilege escalation.