Great IOCs on the follow up spray and pray activity on #PitScaler so far.
For context this activity definitely is not related to the inital threat actor activity in early September. This is new stuff.
https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771
Kevin Beaumont
npub1lc…6lcye
2026-10-01 00:12:49 UTC
in reply to nevent1q…n2cq
Author Public Key
npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcyePublished at
2026-10-01 00:12:49 UTCEvent JSON
{
"id": "328bac26bbfecaafe5239b035ff4e8a1645094a1464c43f32c14f94be9a8a882",
"pubkey": "fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd",
"created_at": 1790813569,
"kind": 1,
"tags": [
[
"t",
"pitscaler"
],
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"e",
"4cbc38e580f94ec5f488a8cd198b6b694e99d387d684eef2c78c58347fad7790",
"",
"reply",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"proxy",
"https://cyberplace.social/@GossiTheDog/117362758120876296",
"web"
],
[
"e",
"23f22e25375736fdb37fe805511e7be087d26e5f2f9d2320672616893bad2bf1",
"",
"root",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"p",
"3507f6c32f8d7e3edbe5570ad3340a49a863d9b75fadd3622d6f6bc5372a2af3"
],
[
"proxy",
"https://cyberplace.social/users/GossiTheDog/statuses/117362758120876296",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://cyberplace.social/users/GossiTheDog/statuses/117362758120876296",
"pink.momostr"
],
[
"-"
]
],
"content": "Great IOCs on the follow up spray and pray activity on #PitScaler so far.\n\nFor context this activity definitely is not related to the inital threat actor activity in early September. This is new stuff.\n\n https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771",
"sig": "989018f56710859ae9000c59c535a73e32167a36fce90d4c7e7d819109fd5c76f605825f1b9ebe2fb7966c8d6bc9d87832015d5fdf741f7713f631d0525b8ddf"
}