Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Update on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Expanded THOR Detection Coverage
Excerpt
Over the last several days, our Research Team has continued to analyze artifacts associated with the exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772. As more samples, technical reports and information from partners became available, we extended the initial THOR coverage with another set of dedicated detection rules. We now have 21 new rules covering different parts of the exploitation and post-exploitation activity observed in this campaign. …
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
IOC Relationship Graph
Building graph…