NetScaler Exploits Create Superuser Accounts and CSS-Mapped Web Shells in Active Campaigns

LevelBlue THOR observed consistent malicious authentication events using 'pitboss' and 'NSPPE' strings to trigger the pre-auth command injection flaw. Attackers retrieved payloads from IPs including 64.94.85[.]67 and 31.56.197[.]72, then executed scripts that created the sec_monitor superuser, archived configuration data for exfiltration, and installed a web shell at /var/netscaler/logon/LogonPoint/.local_journal while altering httpd.conf permissions. Mandiant and Google Threat Intelligence separately documented dozens of victims hit via the related CVE-2026-88772, delivering WHIPSHOT web shells and SLAPSHOT tunnelers. The Dutch NCSC-NL issued pre-notifications urging shutdowns, indicating coordinated awareness before public disclosure. Observed activity moved rapidly from validation commands to configuration theft and persistent access. The pattern shows operators prioritizing NetScaler appliances in government and finance sectors for long-term access rather than immediate disruption. Modification of /flash/nsconfig/ns.conf and process termination of customsnmpd components indicate intent to maintain stealthy control over ADC clusters. No technical attribution to a specific actor has surfaced despite the volume of incidents. Next steps include widespread configuration audits and network segmentation around exposed NetScaler instances. Organizations must verify absence of unauthorized accounts and altered httpd.conf entries before reconnection.