Unit 42 provides attacker TTPs and malware analysis of Citrix NetScaler zero-day exploitation. IOC are listed.
https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
#threatintel #citrix #netscaler #IOC
ssvc
npub1dv…jfshx
2026-09-30 22:38:43 UTC
in reply to nevent1q…3m8m
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-09-30 22:38:43 UTCEvent JSON
{
"id": "7428f4868145d4045b17e958de12c5ac40e555b2c896fc16ca8545b23aeda02e",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1790807923,
"kind": 1,
"tags": [
[
"e",
"00c1cc2d19cf5edd8117c73adda01f24b7892288ff3049601454132e53e66c22",
"",
"root",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"e",
"8eb704e419c0336ea96457bdc31205490977b4a040191398caf43621dd337f56",
"",
"reply",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"netscaler"
],
[
"t",
"threatintel"
],
[
"t",
"ioc"
],
[
"proxy",
"https://infosec.exchange/@ssvc/117362388103178427",
"web"
],
[
"p",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"citrix"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117362388103178427",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117362388103178427",
"pink.momostr"
],
[
"-"
]
],
"content": "Unit 42 provides attacker TTPs and malware analysis of Citrix NetScaler zero-day exploitation. IOC are listed.\n\nhttps://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/\n\n#threatintel #citrix #netscaler #IOC",
"sig": "71a42016b337b2dc992f14de7768f7101d8b490efffa8ee6b7dfcc1956e9ac02a650eddbad3b33c7649e753c792f4fb248d4205932de0a47bd620ea08c62d394"
}