Critical Citrix NetScaler Vulnerabilities Exploited to Deploy Platypus RAT

Key Takeaways

• Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances.
• The vulnerabilities (CVE-2026-88771 and CVE-2026-88772), both with CVSS scores of 9.5, permit unauthenticated remote code execution.
• Attackers are deploying a customized version of the open-source Platypus remote access tool (RAT) on compromised devices.
• Citrix has released emergency patches, and CISA has added these CVEs to its Known Exploited Vulnerabilities catalog.

Cybersecurity researchers have uncovered a campaign where threat actors are leveraging two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway products to install a modified version of the Platypus remote access tool (RAT). This activity highlights the speed at which attackers are moving from initial compromise to establishing persistent control over critical edge devices that bridge corporate networks and the public internet.

Exploitation of Critical Citrix NetScaler Zero-Days

The campaign targets CVE-2026-88771 and CVE-2026-88772, both of which are actively exploited flaws in Citrix NetScaler ADC and Gateway. These vulnerabilities each carry a severe CVSS score of 9.5, indicating their potential for unauthenticated remote code execution. In response, Citrix has issued emergency fixes for the affected products, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included both issues in its Known Exploited Vulnerabilities catalog.

The discovery emerged when Binary Defense researchers found signs of exploitation on two NetScaler devices during a customer’s upgrade process. While one device showed attempted exploitation, the other presented clear evidence of a custom-built remote management implant, identified as Platypus, being delivered and likely executed.

Platypus, an open-source remote administration framework written in Go, was reportedly modified and compiled by the attackers specifically for FreeBSD, the operating system powering NetScaler appliances. To evade detection, the malware was disguised as a Perl-related file, blending in with legitimate system files.

The observed installer typically used a curl command piped into the shell to retrieve and launch the malware. Payloads were strategically placed in directories familiar to NetScaler administrators, such as /var/tmp/, /netscaler.local/, and /var/core/. One specific sample was named .ns_09343.pl, despite being an ELF binary rather than a genuine Perl script.

The method of deployment is particularly concerning because it allows attackers to maintain a foothold even after an organization applies patches to the initial vulnerability. While a patch prevents further exploitation of the flaw, it does not automatically remove any web shells, backdoors, stolen credentials, altered configuration files, or remote access implants already established on the device. Recent reports have also detailed attackers using the command-injection flaw to install web shells and exfiltrate NetScaler configuration data.

Deep Dive into the Vulnerabilities

CVE-2026-88771 is an improper input validation flaw that enables an unauthenticated attacker to execute arbitrary commands on vulnerable NetScaler appliances. Binary Defense researchers discovered that attackers could inject shell commands within crafted authentication-related input, such as usernames. This malicious input is then written into NetScaler logs, where a vulnerable error-handling process subsequently executes the injected command. This command-injection weakness is particularly insidious because execution may be delayed, making it challenging for defenders to correlate a suspicious login request with subsequent malicious activity.

The second vulnerability, CVE-2026-88772, is a DTLS memory overflow issue affecting NetScaler VPN virtual servers with DTLS enabled—a common default configuration. Successful exploitation of this flaw can lead to code execution or a denial-of-service condition by crashing the affected service. Palo Alto Networks Unit 42 has also confirmed active exploitation of both flaws in NetScaler ADC and Gateway systems.

The recovered Platypus samples were not standard builds of the public project. The customized version reportedly incorporated additional modules for privilege escalation, persistence, cleanup routines, and timestamp manipulation. This enhanced RAT is capable of executing commands via a remote terminal, reading and writing files, updating itself, utilizing plugins, and communicating with its command-and-control (C2) server using mutual TLS. The malware also featured a local peer-discovery capability, leveraging the _platypus-mesh_tcp mDNS service, which could assist operators in identifying or linking compromised systems within the same network.

Researchers have tied the campaign to the domain entretiensol[.]com, which functioned as a staging and control server. Other domains exhibiting shared infrastructure or certificate characteristics with this operation include white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, and hickoryusedauto[.]com.

What You Should Do

• Immediately Patch: Urgently upgrade all vulnerable NetScaler ADC and Gateway systems to the patched releases. Citrix has identified versions 14.1-73.37 and 13.1-64.23 as fixed builds for these zero-days, including corresponding FIPS and NDcPP releases.
• Post-Patch Remediation: Recognize that patching is only the first step. Any appliance exposed before patching should be considered potentially compromised.
• Forensic Review: Conduct thorough forensic checks on all exposed appliances. Review logs (ns.log, sh.log, bash.log, httpaccess.log, and httperror.log) for suspicious authentication strings, unexpected shell commands, curl | sh activity, files with .pl extensions that are actually binaries, and outbound traffic to unknown internet hosts.
• Credential Rotation: Rotate all reachable credentials associated with the NetScaler appliances.
• Session Revocation: Revoke all active sessions on the devices.
• High-Availability Inspection: In high-availability deployments, inspect both nodes for signs of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.