Hackers Exploit Citrix NetScaler 0-Days to Deploy Platypus Remote Access Tool

Threat actors are exploiting two critical Citrix NetScaler zero-day vulnerabilities to deploy a modified Platypus remote access tool on exposed ADC and Gateway appliances.

The activity shows how quickly attackers are moving from initial access to persistent control of edge devices that often sit between corporate networks and the public internet.

The campaign targets CVE-2026-88771 and CVE-2026-88772, two actively exploited flaws in Citrix NetScaler ADC and Gateway. Both bugs carry a CVSS score of 9.5 and can allow remote code execution without requiring a valid user account.

Citrix released emergency fixes for affected products, while CISA also added the two issues to its Known Exploited Vulnerabilities catalog.

Researchers at Binary Defense investigated incidents involving two NetScaler devices that showed signs of exploitation during a customer’s upgrade process.

One device showed attempted exploitation, while the other contained evidence that attackers had delivered and likely executed a custom-built remote management implant called Platypus.

Platypus is an open-source remote administration framework written in Go. The attackers reportedly modified and compiled the tool for FreeBSD, the operating system used by NetScaler appliances. They then disguised the malware as a Perl-related file to blend in with normal appliance files.

The observed installer used a curl command piped into the shell to retrieve and launch the tool. The payload was stored under paths that could look familiar to NetScaler administrators, including /var/tmp/, /netscaler.local/, and /var/core/. One sample used the filename .ns_09343.pl, although it was an ELF binary rather than a legitimate Perl script.

Hackers Exploit Citrix NetScaler 0-Days

The deployment method matters because it provides attackers with a foothold that may remain even after an organization patches the original vulnerable appliance.

A patch stops further use of the flaw. However, it does not automatically remove web shells, backdoors, stolen credentials, altered configuration files, or remote access implants already placed on the device.

Recent reporting has also documented attackers using the command-injection flaw to install web shells and collect NetScaler configuration data.

CVE-2026-88771 is an improper input validation flaw that can allow an unauthenticated attacker to run commands on vulnerable NetScaler appliances.

Binary Defense researchers found that attackers could place shell commands inside crafted authentication-related input, including usernames. The malicious input is written into NetScaler logs, where a vulnerable error-handling process can later execute the injected command.

The second bug, CVE-2026-88772, is a DTLS memory overflow issue. It affects NetScaler VPN virtual servers where DTLS is enabled, which is the default configuration in many deployments.

A successful exploit can allow code execution or cause a denial-of-service condition by crashing the affected service. Palo Alto Networks Unit 42 said attackers were actively exploiting the two flaws in NetScaler ADC and Gateway systems.

The command-injection weakness is particularly concerning because execution may not happen immediately. A delayed maintenance process can run the injected command later, making it harder for defenders to match a suspicious login request with follow-on activity.

The recovered Platypus samples were not standard builds of the public project. The custom version reportedly included added modules for privilege escalation, persistence, cleanup, and timestamp manipulation.

It could execute commands through a remote terminal, read and write files, update itself, use plugins, and communicate with a command-and-control server through mutual TLS.

The malware also contained a local peer-discovery feature using the _platypus-mesh_tcp mDNS service. That feature could help an operator identify or link compromised systems on the same network.

Researchers linked the campaign to the domain entretiensol[.]com, which acted as a staging and control server. Other domains reportedly shared infrastructure or certificate traits with the operation, including white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, and hickoryusedauto[.]com.

Organizations should urgently upgrade vulnerable NetScaler ADC and Gateway systems to fixed releases. Citrix identified version 14.1-73.37 and 13.1-64.23 as patched builds for the two original zero-days, including corresponding FIPS and NDcPP releases.

Security teams should also treat patching as only the first step. They should review ns.log, sh.log, bash.log, httpaccess.log, and httperror.log for suspicious authentication strings, unexpected shell commands, curl | sh activity, files with .pl extensions that are actually binaries, and outbound traffic from NetScaler appliances to unknown internet hosts.

Any appliance exposed before patching should be considered potentially compromised until administrators complete forensic checks, rotate reachable credentials, revoke active sessions, and inspect both nodes in high-availability deployments.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.