Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
Malware Families
Excerpt
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation On September 27, 2026, Citrix released a security bulletin regarding multiple vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of them was CVE-2026-88771 (CVSSv4: 9.5), an improper input validation vulnerability exploited in the wild that allows an unauthenticated attacker to execute arbitrary commands. SOCRadar’s Threat Research Unit identified an autonomous C2 framework (NetScaler C2)…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | a9142989d912098856e58f2c74c2266e39150d50bc59722f915dade1ddfddf4a | Medium | Score 53/100 | First seen |
| URL | http://45.143.130.195:8899/a/ | High | Score 58/100 | First seen |
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| SHA256 | 8588d11874ab52a1637953dc5538984647023d00b529f695fbd0e40cf8e5e852 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
| SHA256 | 69a34c591eaaa2cbecaeed10c303b8dcf04c846b8408491da5452b9cfc93f686 | Medium | Score 53/100 | First seen |
| IP | 45.143.130.195 | High | Score 58/100 | First seen |
| SHA256 | f9e06d412dee96d98db4d4588f0012af859cc11caaae3e130697f282447cf07f | Medium | Score 53/100 | First seen |
| SHA256 | a3e26053975daa0a12a4848ce9533e5c439617cd7f69851347be2061999b4cd4 | Medium | Score 53/100 | First seen |
| SHA256 | 4992f575f3f1fc448cf54a4a0ce13cf6548790777abe0af1f935663498ea5639 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…