Citrix NetScaler Zero-Days Exploited to Deploy Platypus RAT
Attackers are actively exploiting two critical Citrix NetScaler zero-day vulnerabilities to install a modified version of the Platypus remote access tool, enabling persistent compromise.
Two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, CVE-2026-88771 and CVE-2026-88772, are being actively exploited by threat actors to deploy a customized version of the Platypus remote access tool. These flaws, both carrying a CVSS score of 9.5, allow for remote code execution without requiring authentication, providing attackers with a significant foothold into sensitive network environments.
Citrix has released emergency patches for the affected products, and CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the immediate threat they pose. Researchers at Binary Defense observed exploitation attempts on NetScaler devices during a customer's upgrade process, with one appliance showing evidence of a successful compromise where attackers installed the Platypus implant.
The attackers compiled a modified version of Platypus, an open-source remote administration framework written in Go, for FreeBSD, the operating system used by NetScaler appliances. To evade detection, they disguised the malware as a legitimate Perl-related file, using filenames like .ns_09343.pl and storing them in common NetScaler directories such as /var/tmp/ and /netscaler.local/.
This deployment method is particularly concerning because it allows attackers to establish persistence that may survive patching. While a patch prevents further exploitation of the vulnerability, it does not automatically remove any backdoors, web shells, or implants that have already been installed on the device. Attackers have also been observed using the command-injection flaw to steal NetScaler configuration data.
CVE-2026-88771 is an improper input validation vulnerability that enables unauthenticated attackers to execute commands by injecting malicious commands into authentication-related inputs, such as usernames. These commands are logged and can be executed later by a vulnerable error-handling process, making the attack chain harder to trace.
CVE-2026-88772 is a DTLS memory overflow vulnerability affecting NetScaler VPN virtual servers with DTLS enabled. A successful exploit can lead to code execution or a denial-of-service condition by crashing the affected service. Palo Alto Networks Unit 42 has also reported active exploitation of these flaws.
The custom Platypus samples discovered included modules for privilege escalation, persistence, cleanup, and timestamp manipulation. The malware is capable of executing commands remotely, reading and writing files, self-updating, and communicating with a command-and-control server via mutual TLS. It also features a local peer-discovery mechanism that could help attackers link compromised systems within the same network.
Organizations using vulnerable NetScaler ADC and Gateway systems are urged to upgrade immediately to patched versions, including 14.1-73.37 and 13.1-64.23. Security teams should also conduct thorough forensic checks on any appliance exposed before patching, review system logs for suspicious activity, rotate credentials, and revoke active sessions to ensure complete remediation.