Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Malware Families
Excerpt
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. We have observed evidence that organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted by this exploitation…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| CVE | CVE-2026-88778 | High | Score 74/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
| SHA256 | c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…