More Shells Than a Seafood Buffet: Tracking Citrix NetScaler Exploitation Activities (CVE-2026-88771)

Multiple threat actor clusters rapidly exploited Citrix NetScaler zero-day CVE-2026-88771 before and within hours of disclosure, deploying web shells, Platypus remote-management agents, backdoor accounts, and reverse shells to gain persistent root access and steal configurations.