Attackers exploiting two Citrix NetScaler zero-days went undetected for at least three weeks and are likely backed by a government, Google-owned Mandiant said, CyberScoop reported Tuesday. The firm has confirmed dozens of victim organizations across North America and Europe, adding a timeline and attribution to an outbreak that has since turned into mass exploitation.

What Happened

Mandiant Chief Technology Officer Charles Carmakal attributed the intrusions to advanced and suspected state-sponsored threat actors and said the company knows of dozens of affected organizations. Victims span government, financial services, education, telecommunications, legal and professional services.

The earliest known exploitation of CVE-2026-88772 dates to Sept. 3, according to CyberScoop, and the second flaw, CVE-2026-88771, has been exploited since at least Sept. 24. Citrix disclosed both flaws, along with six other vulnerabilities, in an advisory Sunday. Mandiant cautioned that its timeline could shift because investigations into the intrusions are continuing.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The attackers used new tunneling malware to carry out internal reconnaissance and steal credentials once inside. The Hacker News, citing Mandiant, named the tools as WHIPSHOT, a PHP web shell that pulls Base64-encoded commands from HTTP headers, and SLAPSHOT, a Python TCP tunneler used to reach deeper into networks.

Why It Matters

A start date of Sept. 3 means some organizations may have had intruders on their edge gateways for more than three weeks before anyone knew a flaw existed. Patching now closes the door but does not remove access an attacker already established, including stolen credentials and footholds on internal systems reached through the tunneler.

The state-sponsored assessment also changes the likely objective. Criminal groups that pile on after public disclosure tend to plant web shells for resale or ransomware. An espionage actor with weeks of quiet access is more likely to have focused on collecting credentials and data from specific targets, and Mandiant's sector list lines up with the kinds of organizations such groups pursue.

Edge devices are a recurring blind spot. CyberScoop cited Google Threat Intelligence Group data showing that edge device flaws accounted for 48% of enterprise zero-days last year, and such appliances generally cannot run endpoint detection and response software, which leaves defenders with few signals when they are compromised.

From Targeted to Opportunistic

Mandiant expects broad, opportunistic exploitation of both flaws by a variety of threat actors now that details are public. That is already happening. The Hacker News reported that watchTowr Labs published an analysis of a pre-authentication exploitation path for CVE-2026-88772, a memory overflow in DTLS handling, and that GreyNoise has seen mass exploitation by multiple independent actors since Sept. 28, including widespread web shell and malware deployment for botnet recruitment and access brokering. Censys counted about 42,700 vulnerable hosts as of Sept. 28.

What to Watch

The number of confirmed victims is likely to rise as incident responders work through appliance logs going back to early September. Organizations running NetScaler ADC or Gateway that were exposed during September will need to hunt for signs of compromise as well as patch, since an update does not remove access gained earlier. Any formal government attribution naming a specific country, or a CISA directive for federal agencies, would be the next significant development.